Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12-03-2024 20:33
General
-
Target
2024-03-12_797cd18f7c0b19341515368747c6e424_cryptolocker.exe
-
Size
127KB
-
MD5
797cd18f7c0b19341515368747c6e424
-
SHA1
63b3f5eabe73f7be153452b686b8b7bffce83d55
-
SHA256
5383ef162d6b86718a80f9440544a51ef74e465694e8a9882811ece914b55a00
-
SHA512
cc50046e9d53da2a680a2d0501b7f0058049b700fc3ab266fecf37995023f62459ff0c9e03165888056ff3198af933ce289858baf8d4de9ac9bf6929f51728a3
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eIEg:AnBdOOtEvwDpj6zK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_797cd18f7c0b19341515368747c6e424_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_797cd18f7c0b19341515368747c6e424_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5ff42f7f3a717c0f68438d39e677abded
SHA1af1057821a49353ce71dc40b413080bb41a0e072
SHA2562043fb5c422a3473d4565bc34a6e09cdf54296adca47bde623f4571230e79ffb
SHA5124421dc3a62c1b0c9348d7ffa6602a66df89a418fc7747cd701037db6e2558b4a0158f42ce7cda6150921e8af98eb5db0e7a1ba76d0fe47f8ad1322f3ed76408f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB