Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 15:48
General
-
Target
2024-05-09_e85b102f2eecfb37ae20e323da590f21_cryptolocker.exe
-
Size
39KB
-
MD5
e85b102f2eecfb37ae20e323da590f21
-
SHA1
a3e088f4c49b288bd68967b2d1c0a255a08bb6bc
-
SHA256
d0fe111e7d6ba2449bf5d2d750cc8c878f772b7883dd8727820e19ac720a7a9f
-
SHA512
89d22fc14afc68d2a6df3e190ee3a755cc210b02005b9066afe507d6b3ac10772012f3eb6df28a3513c537a707e1af3c0c0a508cfcedd95ba072a1d6ef12168b
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaIzlH:qDdFJy3QMOtEvwDpjjWMl7TdEH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_e85b102f2eecfb37ae20e323da590f21_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_e85b102f2eecfb37ae20e323da590f21_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5cab9901a89bba01cfd294db4759f9e6c
SHA16a91feab897e8d08608126a47f5ad25b80ff6528
SHA25690fc6a138951c7f0d29dfdb941928252ce967f117d7c1af11518843b00ec1758
SHA512d427ab84b5f7d87e5103afb0946a906deaa8dafae17f86851fc3f76073f5ae3ccab110fc39685e83fe8dc13def19d164b7cfa5cdabae9f4b27c849d44a7262fb
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB