Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25/04/2024, 22:21
General
-
Target
2024-04-25_0ef4ad25ae4d8195936b6042c9db206c_cryptolocker.exe
-
Size
38KB
-
MD5
0ef4ad25ae4d8195936b6042c9db206c
-
SHA1
32f574472369ae156c8253a73c34b6aad5f39db0
-
SHA256
87f5b4ead250777a0a9e251adec19d23143c814d142aa3910b49841fe8474a12
-
SHA512
3058706363db1d5d158d4632fa28361e521853bfd4a3fb895c3d6abd89efe1c6cd8a3e23bc0694e62d8c31f745f15770248099495ad8ac3da2ca436878f4fd1d
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaP:qDdFJy3QMOtEvwDpjjWMl7TdP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_0ef4ad25ae4d8195936b6042c9db206c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_0ef4ad25ae4d8195936b6042c9db206c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5eeddae2f48d6729f9442a9dbc75a2cc9
SHA1acf95b4ca60a8b1701a38b20ad25ffcee44732ed
SHA256a3c89c59a98182b690d360142d30cd6a393c1f65f3c1649c1011dab1cf1fba06
SHA512079e8b6fd2e229bc7df06e0da459c65f47e4ff87283efc596dedf8c05454eb455ac11f988c3525715244b1f377b4279a50e7492193bc61518cde8dd03ffd487e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB