Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/04/2024, 08:47
General
-
Target
2024-04-11_8b43dd80c07a44a43e1b5405542cffc6_cryptolocker.exe
-
Size
84KB
-
MD5
8b43dd80c07a44a43e1b5405542cffc6
-
SHA1
5274da1e81e25d0b4db6940debd6193ff694145f
-
SHA256
61353dc03901181f46ccaad082c480d0537410d55d8c8cfce6f3fb1d168f2c3e
-
SHA512
f05a5b6abd7221413fcdf615090d529486bc6448c6496fce0d94f7a0fa5274ee349977df3faec6a4266280285e67a4889028209a96b06a0a6ccdc06e52b7622b
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT7vM5R0:T6a+rdOOtEvwDpjNZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_8b43dd80c07a44a43e1b5405542cffc6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_8b43dd80c07a44a43e1b5405542cffc6_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5939ce39538a504ff280dc45d9a4b8394
SHA14c4eaa949beeac0e75a8c554200b2be38f8c8316
SHA256c5066c12341c1fd03c7bf8178e02d61af66ab044fe7f836eb016449679c6585a
SHA5124d5f04b498d2598d7cc0730ac236d1ba9d7973d3f94b4709ccfb030f30f6dff28f775b112784b1343283caac45381f309c366c601d277b0b6291d62f2ab90128
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB