Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
20/03/2024, 00:33
General
-
Target
2024-03-20_438c67f1ad3aa80aee64fbce1257396b_cryptolocker.exe
-
Size
35KB
-
MD5
438c67f1ad3aa80aee64fbce1257396b
-
SHA1
9f41ee9998649da7067682c73e7150f42203a9b8
-
SHA256
fced233d56897cbb6818f5503e958499fbc3fed0426283dbf4bc9a93e767e012
-
SHA512
cb183b1b831531dea5a5fd5479d2c4e318a653630be2e3ffb2585c043ace183b0dd6963f6a47ee93cf472e39a621dc89ede0f0b02635e8773a7aa153d3b141bf
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkUX:qDdFJy3QMOtEvwDpjjWMll
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-20_438c67f1ad3aa80aee64fbce1257396b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-20_438c67f1ad3aa80aee64fbce1257396b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD547b4e63ffeb3cadadffd0dfaa4da298a
SHA1aeb2975ca918f84c04d9e59424b7d6a6fa2b901b
SHA256bb2f46c548f25c345c70063e21c06ace0e4db64ac19156f419c269cb0e560e4c
SHA512c06612d90dcd740e5992d662bcaf9ab4bf0c0f843683f6a96e31338b04b6983df5609662a0a3857cab7241b23fa16ca38d23881474807c5dbac8de81365405f3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB