Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/04/2024, 04:33
General
-
Target
2024-04-05_ac41e415e4fe1da4d9c19aa8fb7e69f1_cryptolocker.exe
-
Size
36KB
-
MD5
ac41e415e4fe1da4d9c19aa8fb7e69f1
-
SHA1
e3d01f29d35b8ccebaec6f81234ce2dea0198967
-
SHA256
c0e9046453563567420a97e1aae7adf6f02740153fd91f259f2d9d5d3e959b03
-
SHA512
94f4426e35821467a797bb707fe692156b5b9c35a232aca81031fb75f9ed8d8dd3cf5300177f9549a88820e9573717e8a1d34f606b4f86e473a580d129b1a93e
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITnc:qDdFJy3QMOtEvwDpjjWMl7Tc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_ac41e415e4fe1da4d9c19aa8fb7e69f1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_ac41e415e4fe1da4d9c19aa8fb7e69f1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5d043dabfb220f93d40f9b2cc5c58b712
SHA1ab92c3b5ac777847b765c373c41a4c24f1453eb1
SHA25632af9c64f2c98783c552b6e78e418d578a707678f353a588d0bb40d679fc9504
SHA5120369f328bb3eb39430e6caf0a198e52553b59989cc95a934cf5ec5b7333d947ef3165bb3bc91352b45645194470b25c57b3e86a930970210347e26e8415118b8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB