Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 14:30
General
-
Target
2024-04-15_297f9643b8e9e28bcda8a7dcc8dcff33_cryptolocker.exe
-
Size
66KB
-
MD5
297f9643b8e9e28bcda8a7dcc8dcff33
-
SHA1
79753f799f1dccfe5f66745b450ea134daea4ee0
-
SHA256
7dd5b23aeee7ae2eb79513f6467538a84a4b4b20a505a0cf550a34f8f9dff1bc
-
SHA512
d5b0bc05e86d2640d7055bc79487107db3745321bc22329361e56a53d3dc42cb8db7c9605b001386e3f777166d8a4d3b56bd0ac149d8a1eb47a5fc8442337272
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAoQRhk:1nK6a+qdOOtEvwDpj/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_297f9643b8e9e28bcda8a7dcc8dcff33_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_297f9643b8e9e28bcda8a7dcc8dcff33_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5496f80e06e142c1b7cac5931b5c4789b
SHA10cd452c664d93bc0390c7ec701285ffa768d69ff
SHA256724b7a2e417a02d96f0d85edb67b97914595e9b51570a7db649135f628d6545b
SHA512cd31d11600da73f3c2e5919dcc89c7363a7f05bab1620fa8daab3275c86bb8974d66f53a6b013b3d477f03f144a32ec0a00c7093e99a889616c8815035383830
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB