Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03/05/2024, 11:38
General
-
Target
2024-05-03_b101b6f3541cc5cc4db53e1b27f094fd_cryptolocker.exe
-
Size
38KB
-
MD5
b101b6f3541cc5cc4db53e1b27f094fd
-
SHA1
d0df3dfc75f5af36dde98229c163a072f28e4850
-
SHA256
36e41a9cfebdae8b8ba11002e09bc298010b6513bb95ba67f4ea52386c10000a
-
SHA512
7e79b6d44a8151d8dcc1abd67208a862390d7f9901ebf97471364f4beecec7f9e2ff474e8729da2f05924faa73719765f080c47e5bd582b4a02fc4c88e957808
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYan8T:qDdFJy3QMOtEvwDpjjWMl7Tdn8T
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-03_b101b6f3541cc5cc4db53e1b27f094fd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-03_b101b6f3541cc5cc4db53e1b27f094fd_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5ac146ef11919004852e0ad0288067a8a
SHA133e8319dddcf21b1db80edcda6dbe4ce55f72d15
SHA2565a10e50fba5fb39485e40ebdf1263843045e1c05cecfaae341cef98e15e46308
SHA5120c65b4496639b486b00326a2553512a189c3c21a5343285fa59059cece8ca4af01560271ea209d32e5230d816fb4053b0544111bc4c6270ecb5e61ded33db6d2
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB