Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-04-2024 15:33
General
-
Target
2024-04-09_6e72fd8e55df2676995eb5c47fcfe074_cryptolocker.exe
-
Size
63KB
-
MD5
6e72fd8e55df2676995eb5c47fcfe074
-
SHA1
b35ecc44a1056148044040ad2a300ac64927ee59
-
SHA256
649385aede2d0b141af14e0c2bb973c8cf0842a241639e0ccf68763661aaef49
-
SHA512
2070efea6cf6eb530fe0a268ccb5ff4606f86996ca52c7d603571bde6a97e92e75c07377af2595e8f97b5a5382adc135a3ef927b6dc6f960dea873859e66ae27
-
SSDEEP
768:P8mnjO6LsoEEeegiZPvEhHSG+gbum/kLyMro2GtOOtEvwDpjKvWxHCbSVaFn0jKt:P8mnK6QFElP6n+gymddpMOtEvwDpjYL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_6e72fd8e55df2676995eb5c47fcfe074_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_6e72fd8e55df2676995eb5c47fcfe074_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5491a321530bc9613ee583d5392ea8679
SHA1f3b20a21fc9a9931831d6393e9130e5a83c312d8
SHA256a81a3ff9257601b449d4ba17c42947fbfc31c1a097a8ea13c766f30ae183d1dd
SHA51223377c485c6fa73475df19e2cfefad0a08282053e6c67100247afdd5d881f207f35b95473fa76283904f63588b061186a24544eadc09d0e7a6dce261c09635b8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB