Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 01:33
General
-
Target
2024-04-28_89ed7c6221c1f7f68c3fef6ebc5b9470_cryptolocker.exe
-
Size
39KB
-
MD5
89ed7c6221c1f7f68c3fef6ebc5b9470
-
SHA1
78b808d6f5793066a24080f10d9d3b91b8321f6b
-
SHA256
d9a2e22f334181e26950c18ee3cab7930aaa3c8774990150bdd1964a16e0f1d9
-
SHA512
8cbd0c4a0e0cbd83078315e88a95744be738aa6207fe54f9bd1c08cf60801e2b35765dfd529a6ac1d73ca1eaf7c03978242fdb05e5922599af949dd05d44dabc
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaO:qDdFJy3QMOtEvwDpjjWMl7TdO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_89ed7c6221c1f7f68c3fef6ebc5b9470_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_89ed7c6221c1f7f68c3fef6ebc5b9470_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5c62ece464bfb507b0f2051069c7a3acd
SHA13700fa31a4e65455f43af03d649eaa4a3ff1f606
SHA25699b5915eec6ecb3cf38694c1cf8851674353b879bc4531be12dac5cfb533f7e0
SHA51299d271b00008c86d50e60c9478ab68576ce8e00bea7dd6629cbcb055d85f88ab5a7151234495adaa0e8971d06e83732545d03d6d6afc07d5a1a91aa1b76ddb06
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB