Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28/04/2024, 04:46
General
-
Target
2024-04-28_aa765b0d2b283b292ebf2f7aa43c82a7_cryptolocker.exe
-
Size
66KB
-
MD5
aa765b0d2b283b292ebf2f7aa43c82a7
-
SHA1
a3a2139e643e942f725f09f42459e09bf62c39f4
-
SHA256
4e240b62c21786260b651865ff096d6774026cd10effcb234575b4713173c03e
-
SHA512
aab8454042f51289a9a5bfa1d3e1c6e8e3edf3cf43b26348c506c62e4174210d9ad47415a3eb798eb06167eaa8c58268314f683a41ca61321e015ed69df70cf3
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xDyi:1nK6a+qdOOtEvwDpjl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_aa765b0d2b283b292ebf2f7aa43c82a7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_aa765b0d2b283b292ebf2f7aa43c82a7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5008d2973fe89d12fbfaa9aca980f6f90
SHA1210c23ad7c4f06ea4725916d202e625ce0ceb707
SHA256055ce23d8a195c0b5d4bc09784cc264c3a97944271b0081f363c0a1b6ffa2d3d
SHA5126c171b9f4ee5e61fdb791302a426a5ab574114f67ab4e0d7af37778240a0d872b0e221f1a6cb30f74951f43b62d1104d50c5ee696ee8367aa25906080744661b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB