Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25/03/2024, 11:32
General
-
Target
2024-03-25_482dc731b8907bd921fb0c4388409aa4_cryptolocker.exe
-
Size
149KB
-
MD5
482dc731b8907bd921fb0c4388409aa4
-
SHA1
d43834e994c5172455dae6cb1c7c2ce7853da818
-
SHA256
be7190dcd4d3b1a2f8054f655c9fb3859f257b2f7b29558adf2c61d2daf2e8c9
-
SHA512
0bb6b265a02df17edf66a3c2638eeeffea0604ccadf918123706086d3019c59d5aea907ef79123416dc4ca475ffc443e3ca6c52a08a2dfe923152c193a8e6e93
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699GNtL1emn:z6a+CdOOtEvwDpjczQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_482dc731b8907bd921fb0c4388409aa4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_482dc731b8907bd921fb0c4388409aa4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD536fd8e31ea5394b598964da1710545b2
SHA14c814132924549f34edd19759c778349aed7d5f2
SHA256ec793de912f9cb9a2d7f50a587c876c3eaa83630fe595d92dc3d895f91c70adb
SHA512926bf75a498bced3f53ccb464568c830093bc247d3cd9bc6b84e3931d63d6ffaa5b7cc9325d2d654aaa6cb4e76d7553973f89c254ff0ac36f5aa5196435ea1db
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB