Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 06:00
General
-
Target
2024-04-17_c186c2aee74201cac66837d460e79363_cryptolocker.exe
-
Size
67KB
-
MD5
c186c2aee74201cac66837d460e79363
-
SHA1
3fd93170cdde1d4d612ac558a4d396c8c30775d1
-
SHA256
f06da8f7e46a94e40433c1585eab87a92bcc38b7dc936e9f3b07bc2df9c04d5d
-
SHA512
a00bec9a9030d36fb0ca330eaabe43191d7f2e9ca27aba03dc6a66bbe704600126808f6a6950eb455a29a3047f2fc673599f4f2483fed093dc7ce9a5cae6bfa4
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1P7:quJu9cvMOtEvwDpjWYTjipvF2bx1PQA7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_c186c2aee74201cac66837d460e79363_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_c186c2aee74201cac66837d460e79363_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5776f1a46a128990a71ddbb899ad28ad3
SHA1d022b2c0eb09c108204a83ad232b524d3feebdd9
SHA2562bf1e63ab3acbaad608c746ef598638c26e5f3ac213445331b45bfa67a6caf5f
SHA5120ea5857308e487c7588dc40f6458e8d5e80dc06b84bf052d36ee632cc4f7e705856b9f87136b3b41f11d5860f1396d43c1694eb22f5026ac00e97787a1c95713
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB