Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05-04-2024 05:38
General
-
Target
2024-04-05_822a074fd85bfbc5cbf79c2c277bcf13_cryptolocker.exe
-
Size
63KB
-
MD5
822a074fd85bfbc5cbf79c2c277bcf13
-
SHA1
0bbe03a0cf115319e9eb2b7ba477c72289b1d5ad
-
SHA256
533536c93e31398af2a67bdd501297d938dca3b6d05089a801548d94ee6a6f4e
-
SHA512
75dc58caea38a2885260935a9c72e6879e6632e768fd161b0cfecaa62b7946ec0a2a80b4d57f4926bded87a7cf58dd878b34f9e0ef7e0cc9375f283d0c44dc10
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY7DWjE:1nK6a+qdOOtEvwDpjc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_822a074fd85bfbc5cbf79c2c277bcf13_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_822a074fd85bfbc5cbf79c2c277bcf13_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD513dfc3a145c3f89e71862e0bc05167b0
SHA181169f3c1011207964314edb2ea5e7dfde6178d6
SHA25625f77cca55de97c2469c61a4214f092e075acdfb0debd4eb6028b5d82178be01
SHA51232b703338dcf727bac43b87ffecb5d5624240aee582dc8b2ce3c0339d0141f99b1d648210475ca5e038757a5b1256118678135a5216a33c129466d1c7b3d5865
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB