Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/02/2024, 09:40
General
-
Target
2024-02-29_69b242eef6e3a04f07e853e9763ba8ee_cryptolocker.exe
-
Size
82KB
-
MD5
69b242eef6e3a04f07e853e9763ba8ee
-
SHA1
f802d20ad547cfee056d98307485bebe6cf61b93
-
SHA256
dffcfc5b2ad2acac38f56a7d739e12335dac26285c38829e29bdcf3eb756074f
-
SHA512
ceb915b982fcaa711deaafc88c37ffad187d775c69ef4fc78013d2f2a62d32b31e6ed953898213a23a10a06482377eaacf7eac5237dcdd3d4b8d1c77dcbbdca5
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT76u:T6a+rdOOtEvwDpjN3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_69b242eef6e3a04f07e853e9763ba8ee_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_69b242eef6e3a04f07e853e9763ba8ee_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5083de2f7e74fe3bf5a5b809a020b67d5
SHA1269fecbba8acf8f40e30e9ec147772b120d92d12
SHA2567f3e9c6245cc6bb7dab503695bc7b81f9eedc0d0831b89c6aee88b6b6532e8d7
SHA512d18f9218920b653ca6b7aabaa8392279dcd409e684942817d558511892b8415bcd7bca22f18c30c0e0e8014f45586a6e33bd4da2e25d75d75fd8d5dc32965a52
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB