Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 18:45
General
-
Target
2024-04-17_0206a9312433c65a85f96f3b7236aaba_cryptolocker.exe
-
Size
38KB
-
MD5
0206a9312433c65a85f96f3b7236aaba
-
SHA1
7006890e2dc70049a5d3718f96200a641ea5877a
-
SHA256
bcdf7534011e78d0450c77229435029800adda21994ca3c4917a17472f30a1a1
-
SHA512
fab592fdf673d5e58d6859030b207d2488f6d27e27c03e95021847d72c2a4ba6a20a5456da9c491c96423fef3c3f42da6832a21355f4942295322222ef9b578f
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYar:qDdFJy3QMOtEvwDpjjWMl7Tdr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_0206a9312433c65a85f96f3b7236aaba_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_0206a9312433c65a85f96f3b7236aaba_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD501a7dd7ffe1ab1456201d391bb2f1921
SHA1b967a6293545da8e23213f4036e7fd9adfc887af
SHA2561c13f371e162d320f5fa03e124c2c54808299b502ff3ae720be21f0546791284
SHA512fef4e6313982a8055d3c50abca9acefc3da06e90544b70b8cff4b60f96d39c34c54324f7602f061bae12ebabf0b25fba1a93d61fcca538a4da0f5668bc6ff0a1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB