Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 18:58

General

  • Target

    2024-05-09_ff5de014c8961740b338cc6b3c2c102d_cryptolocker.exe

  • Size

    73KB

  • MD5

    ff5de014c8961740b338cc6b3c2c102d

  • SHA1

    78ce5a7217aac3ccce9c8a84c9e1a4a5538111f4

  • SHA256

    49d5333065d8f9baec4bf5f96c1423ab320745b5e87bfeffda981ce4e74cea87

  • SHA512

    2675a4e661915e44287dc8122703904efd015b62fbe2fb8a252840df7ab46b4db1571583c8193978ad59ac23b4e91bc87b2369d7100dbfd11e44ed550549e18f

  • SSDEEP

    1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalVJ:1nK6a+qdOOtEvwDpj2

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-09_ff5de014c8961740b338cc6b3c2c102d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-09_ff5de014c8961740b338cc6b3c2c102d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    73KB

    MD5

    ea2391f7a7757a4ab06cf89dd778c7e2

    SHA1

    4ea5e7ba281d3eb0f8c3b0b2a4dd573b4549242c

    SHA256

    a85617c6d8e15795c4bc1d581853881bd99495955d1e4d62bfb0e1dc5230cb02

    SHA512

    df99b3d783a04551456227dc9bbcea5c75bcfcacd7fafedf954f35daf196b4c41b065d69740249a400194a3ee555e695ddbccfdf3c9f9e6f85ea59edd791eb3c

  • memory/2260-0-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2260-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/2260-9-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/2260-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/2260-18-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2600-20-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/2600-26-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/2600-17-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2600-27-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB