Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 20:36
General
-
Target
2024-04-15_40dc6184e515b2ac534068b222398f81_cryptolocker.exe
-
Size
94KB
-
MD5
40dc6184e515b2ac534068b222398f81
-
SHA1
e03bc176b781390dace81b898e8fa2b861185235
-
SHA256
1fe2672e02d03b0518fe71f5ff78e8e054a72ad642bc753488c57a35a0212be5
-
SHA512
97cd3d971bba7eab0ac59c91df85f0c55762379719ff2f80b2cfdc91d3cded3b62890b27275535bad95e037677c8b2c6a6a4af30e45094457ecd6ea706b9d02e
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpYWn:AnBdOOtEvwDpj6zW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_40dc6184e515b2ac534068b222398f81_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_40dc6184e515b2ac534068b222398f81_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5bd93399ba675c01260d32fa17c903051
SHA1a4b4c66453f361608a70794ff809853a166497ca
SHA256a6904198a80837aff62c84b3f95789a060b070868b6e073ab798b080547c4f07
SHA512a650a808a92d0fe2b8d7f45896694cbf496d3160a9cf7bc9eb2b1bd5eeb185eb33eb0b4a14f2c50e09e2a4d7405727d1e6430d89e83bd302724016730965f1fd
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB