Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28-03-2024 00:56
General
-
Target
2024-03-28_ecf1412b0acafa4f9321c36d2c78932e_cryptolocker.exe
-
Size
92KB
-
MD5
ecf1412b0acafa4f9321c36d2c78932e
-
SHA1
ecf1210e34a270579810ba057748fd852964fa71
-
SHA256
d08b6afb287218bcb7a272f59272147e6b394d3cbf48a0ff02b8796905bb394b
-
SHA512
eaf74c42123d7d1c5e147d6d37b8ff524fed976a3d36318b77efafb125168614b75d717d1055bb2616fa1be6adebd3a9444c46ee7fa6b5247e40933dd2570c7f
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01n:AnBdOOtEvwDpj6zl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_ecf1412b0acafa4f9321c36d2c78932e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_ecf1412b0acafa4f9321c36d2c78932e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD50ad58e6f2e5f067e9c86615ed1fdd87c
SHA16e9e7c7df048411cc156783abe7894b1ffcc2343
SHA256dfa3cdca65795a991069354535125732d000fdf9862bb5e0e4171dd390be10d4
SHA512fbb69753348adb12050bc4ca959469f891aad8727510c81282ac1d0115d0347b71510733cd7d15a6440811fb50423ea256ec3526aa4937b579ad01992d906931
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB