Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05-03-2024 06:24
General
-
Target
2024-03-05_6b36165427687ae9f1d2fdfd941f707d_cryptolocker.exe
-
Size
103KB
-
MD5
6b36165427687ae9f1d2fdfd941f707d
-
SHA1
dcd2bc3adc2b4fc7d784f703c850cf53ab8a6aa1
-
SHA256
59bc0b019810ec4e6332a03444b7c60d1b0ecf905a0c908137aa333875ed8308
-
SHA512
9684bdd0aae3541b228ebf0b176136578231c23f815202e93a163e442d6a930e55e6cc6193795d0a43a4f496695276caa6eb129bf9edb74936045f2b3ae4d7e9
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gksq:1nK6a+qdOOtEvwDpjq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_6b36165427687ae9f1d2fdfd941f707d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_6b36165427687ae9f1d2fdfd941f707d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD55856a43801180be3ca6826f4f5797ed4
SHA11bf3327f7ca20b880876f5b6a69f2ca5d3daf154
SHA2561d6ad0302ea799cc73f60d5272e744baed5646c5ae0806a52564c5b7d48329a7
SHA512acc7107ca494f84d171f60a3915267027aacfdb5c7a5747016dae1ee28571b5c35a85a628f8ee9d293a4b1bb032f0da54914a4c72a1e49aa233f6ae4a2f2b07a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB