Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/04/2024, 03:30
General
-
Target
2024-04-10_2b51c906fb05d295ee108a43c6c0b13a_cryptolocker.exe
-
Size
66KB
-
MD5
2b51c906fb05d295ee108a43c6c0b13a
-
SHA1
0c2eed42066b27657fe050519b012a98c0e5a539
-
SHA256
102076a272e32c11d14d5384088c437e840fe99847cd257955bee4c63aa7d53d
-
SHA512
d8db3a9c3b482ec6e889b5b2bbea52f0e618589934d48e14c3c0e3fd68b3012343163aa2a614a77a3f7a0afb25da05f9a8b848364f0cd4c2f4813e66780c7f0f
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1PG:quJu9cvMOtEvwDpjWYTjipvF2bx1PQAG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_2b51c906fb05d295ee108a43c6c0b13a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_2b51c906fb05d295ee108a43c6c0b13a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5950bc5226c33e4a40930e1f7f74622f0
SHA1a965513553c676336d1de0451fa44b0528bd2b35
SHA256a96654525200de566984f4cc268a815c1e5b4b547a12cdc4015a96f5b5828ed0
SHA512e104a659df332fa463b48dfec677bd7d2f4720c4070c4f5955151261a08383900cb6c9822ba08125c9e1f6e0ae28d91e4d42d058dba3246e291510529ccb55e2
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB