Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
29/04/2024, 02:35
General
-
Target
2024-04-29_8109bbc05f6ad4693c0b7cb06e528e08_cryptolocker.exe
-
Size
96KB
-
MD5
8109bbc05f6ad4693c0b7cb06e528e08
-
SHA1
bd1702bc34fba5355e773acca6e0a1f58d2f0580
-
SHA256
5e266f7ca5cd941b6fe81c4c99d86305376548641c2e50a50ff7b71dd6de5ebc
-
SHA512
a9c8b42720c80f12753144f2a42263e20b01e1cbe86fa66442f18b13f31b32bd048751e6fdb5d45167b4420441d77d4e5b0c9d548715c9f288b087633139da24
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/bqB:zCsanOtEvwDpjBU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_8109bbc05f6ad4693c0b7cb06e528e08_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_8109bbc05f6ad4693c0b7cb06e528e08_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5e8d18de529a17cc864b74b3147643684
SHA12ecc2e00f96832aaf80c360e7469e102cff6ae3f
SHA25687294cf400d85b4e8d16e1883b3729b5ee8fbd3a73bfc838b8f5c426bfdec43d
SHA5122ac80a23d1bb9db5248bcfcb2b3702b0e035c871ad02c645ac509abba3b39e63b5e67277692b62e864bd3637b64bd23df52708218af3cb98e37907bdb1b69047
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB