Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29/04/2024, 13:36
General
-
Target
2024-04-29_a28935d2e0cff89c32df69c2b3e62f27_cryptolocker.exe
-
Size
147KB
-
MD5
a28935d2e0cff89c32df69c2b3e62f27
-
SHA1
d7a8f468893778e527753dbd9b603b8a961f8431
-
SHA256
81dee62289fdc6ee82fb06476d25b7824d3d270e7e5520053a604826f8b593b2
-
SHA512
e36d10ca918c04eac77104e9a694647a60200e7e6c459a3187d4dca34153682ca129c8476784babb989b31be6033581ecc0f002540afaa3fa7a2372b1a66a191
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNgp699GNtL1ecg:T6a+rdOOtEvwDpjLzT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_a28935d2e0cff89c32df69c2b3e62f27_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_a28935d2e0cff89c32df69c2b3e62f27_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD5af5bd9404f07c7d26f1a0fe8c420239b
SHA15b48f9c04744abaf7fb280572b07ba5043f05da2
SHA256b869445d60d5f4afcee0715ea566b6fd6d68fcdc4d138588d4b95dae72f623f5
SHA51216a3e5d34f79f8610f10df49539899c4798c6798ca12d8abe6db8864112633269e8e9087947c4eed6115ef652709f0678ea6ff48774e8f954fe0b55e0d94a64f
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB