Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/03/2024, 09:27
General
-
Target
2024-03-08_263188ac38372244885b743f34b57fb2_cryptolocker.exe
-
Size
92KB
-
MD5
263188ac38372244885b743f34b57fb2
-
SHA1
6ad96b3b5b8d44147f30556ccbc51784f49c0de2
-
SHA256
36c81cb6586d2c0e8b3fc8c7ccb3e425cb0698411b3ccda1991fd9f788cf0294
-
SHA512
507b1dc752815cef8ddc741f851e079a5d6c9ce97958f12ff7f1af6eeede143d07746d4a51439940d2aca64dd5975cf13038c60f8e86ac1bc470667a4782345b
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp0+R:AnBdOOtEvwDpj6z+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_263188ac38372244885b743f34b57fb2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_263188ac38372244885b743f34b57fb2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD58f00fba362f2770f60d6adb4a9ee2ecf
SHA13d36dc4d36acdbcd7f6fe85860a3d4cf3972086a
SHA25693181fb568479869f7eaed8fbe14cfd57416848a4694a6c67ee1511e4faa4b66
SHA5120fefa2164970b4e42c76f5705f977dd3449d94735d74c4a4b4f83946e8f01ecd60225e65a20b39d523b66fd95d8e4fc6f57ba52ecbc8d526787480803230d5e8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB