Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
10/05/2024, 22:23
General
-
Target
2024-05-10_a70e4409eba0ebd8b8fcd4cee122a92e_cryptolocker.exe
-
Size
89KB
-
MD5
a70e4409eba0ebd8b8fcd4cee122a92e
-
SHA1
e55532514bc35536587500c0ade0ff56b5d6228d
-
SHA256
d929784b5cb0a8a11868e8b77b4f610e3d2aa9a6087f9e38fc01a06136b8808f
-
SHA512
ea45a1983da1df481b741ee42d13a3b5c3b20b5430932cb996710c85e4f81f2fcf41ed545cf8b35bf3e51eb76d475a8e1d5904f152d6d7c2679c3b5ada2ccd71
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/u:n6a+1SEOtEvwDpjYYvQd2P9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_a70e4409eba0ebd8b8fcd4cee122a92e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_a70e4409eba0ebd8b8fcd4cee122a92e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD57bc7923a07f3047abc14270c94f58a5d
SHA101afa0060b0f0cb58909c87db2fdc19e2300257f
SHA256f0d1ca7b0aaba68fa62b59fb487248deac68d9427e92b4c31f3ee9001dd93b49
SHA5121a3d9a2f0c203083a67f05de9fa794c3b3dd6ca79bc30d5ee8726fa8c4f56473067e619ce49b1dd0b527ed4064f52443e1face17c09ec7da46f096ce90d83482
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB