Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 12:32
General
-
Target
2024-04-17_fc028262d2c67c32a7bc8f68aee5f5bc_cryptolocker.exe
-
Size
72KB
-
MD5
fc028262d2c67c32a7bc8f68aee5f5bc
-
SHA1
95b92b73a0407267a78c9e3466746ac96c6ad623
-
SHA256
bdf5fc63c9eb11505b9d17763c85e57908d493d562e1613ec113ef15dd78c8f6
-
SHA512
383a39b8fbaa7dba10148bce7f93cdf4dc01c79b0c5525492b26b115dd7f00475d9b529da26d4e31fad97a2a57590886748b122cbc20c8e7a2b449068f5c9146
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBt:z6a+CdOOtEvwDpjQf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_fc028262d2c67c32a7bc8f68aee5f5bc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_fc028262d2c67c32a7bc8f68aee5f5bc_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54783b4a96c50f8412e3970d6fd76f71a
SHA1c83c983e647791103dbe85a2f619dde88b8dbc53
SHA25666871580843ddb930111eb8cd4479cca612e7ae373aafb3484ce823c62b76d34
SHA512d8d0311c91cc94c1f638a1f108797b9b88d328464e2916a9fb3e69d5e53d83ae1f6e7f18110fcb5f42db1641626c6ebf277fc4557cb65e265f4a5a64cd79d27b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB