Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27-04-2024 19:28
General
-
Target
2024-04-27_2204073432d32b0a1b05b526195141ed_cryptolocker.exe
-
Size
57KB
-
MD5
2204073432d32b0a1b05b526195141ed
-
SHA1
2a4155e5dc73c8b44fcd500a0442d42a0a74cfdc
-
SHA256
441e45997a413d5bd227a0b811a8ebf060e661331b0edd1f4aa04f700ac7047a
-
SHA512
4a97982d7f464e959b04fc898f79134ee7e0b4f661d05400eeb72613e8e2d132b2ce1cd6984cf409c5f6c9567c1724c0de58f15238ad529b6d601274519b6454
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPBx:H6QFElP6n+gou9cvMOtEvwDpjCpVXYx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_2204073432d32b0a1b05b526195141ed_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_2204073432d32b0a1b05b526195141ed_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5c525e1aa41e769678625252a3f4cbfe2
SHA1c4341df9b67903512a8ec6530245f3accf99210a
SHA256141b1deef411e33dc9c22bd164640389a3f9dab260bc73e04f24020db094a15d
SHA5126d7945cf112c55ec8ddc7e71f238a4b01a8a52dc8fa5f4d858a2d5a0764c6e817f3036637f26ffca144ade1b7024d6fd1eb9d7590ef6c5debc273d174bdc399b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB