Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 19:39
General
-
Target
2024-04-17_c57c35215277cbf4d7f1ff3dc8658404_cryptolocker.exe
-
Size
37KB
-
MD5
c57c35215277cbf4d7f1ff3dc8658404
-
SHA1
66d73d4dad038d13a15fff87e8eef25f127c2716
-
SHA256
bd40050a02be373c2d4e528e162e3853bfde18f0e5da1b78612c69909d4f3a5e
-
SHA512
63176d02a2b8f191892a75cae4b48a24a0f520d69a02a36ac5c926de4220c972a0727f6978d3fa56e666400b3e652267313062f594ff08a9d465b5018bb41c85
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYKW:qDdFJy3QMOtEvwDpjjWMl7TLW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_c57c35215277cbf4d7f1ff3dc8658404_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_c57c35215277cbf4d7f1ff3dc8658404_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD50a1e7e6be4b78af4638b6580a0c43ac7
SHA17273a4d09ae6ff3eb2671f40f947a2de1fdfb027
SHA2568395b8d5ce00215f88cdcc2baee3199e6254f2d713fcc3d1bbc98ff4e80fc401
SHA512f36d96f8508301c216d64dee7bc1dd80da0cd253d90056e8a380b28e94bc2aab57b99bb1b44eb816d75722fa25808c823e1148eb8f4aa669d64689d4dce266df
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB