Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 02:39
General
-
Target
2024-04-22_f6ab8b98441d7767ec5fb7061f491883_cryptolocker.exe
-
Size
68KB
-
MD5
f6ab8b98441d7767ec5fb7061f491883
-
SHA1
d02d91288238a61de646e476951454070c609f83
-
SHA256
909fbfc9f9c4aa20913f96a82e35b71b9ab5826200584b6bfbf19a9e6add6c2f
-
SHA512
d0d2166271ccf7b453f5f99d9bece5bf7fed191cd7fe31a8449f14fc39eac35fcbe0bc44947d0d6465133676e5ca1a59d46e53185df6bcd6dc5f6726156102d5
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1Pv:quJu9cvMOtEvwDpjWYTjipvF2bx1PQAv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_f6ab8b98441d7767ec5fb7061f491883_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_f6ab8b98441d7767ec5fb7061f491883_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD51e67970184366ffed8414155616dd55c
SHA1a907e39df0fac6558cee8dca853acd99dc1285d5
SHA256604ecf3d25b3fa72febfa4c2add09a0f8bb136389799aef092cbb33345dd8cba
SHA5120c450b658dfa11aaa27a088eef0f23346964564823adf5aa4ef5f9e48ef5a270cf11fa7db37a984286f642ad5c77de992e96c20abffe089c3d9cf2cea2d1c54f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB