Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10/05/2024, 01:37
General
-
Target
2024-05-10_f1acbe66ca726fa24aa67c884f1b189d_cryptolocker.exe
-
Size
89KB
-
MD5
f1acbe66ca726fa24aa67c884f1b189d
-
SHA1
22efb1e65a59d24fd81598d6124cb55f6d594071
-
SHA256
6cf2c5a519ea2466a81d9be0059172a103134e75385ed13dd64077985751f75f
-
SHA512
da2a847472adb4ea7e8229bedf555c9e1ef471f4757f3fd603b690085d8af5b247269b065a7aef690efc80545f916e92834b408dc5dba6b360b6f2c43b60e8b5
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/Nt:n6a+1SEOtEvwDpjYYvQd2Po
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_f1acbe66ca726fa24aa67c884f1b189d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_f1acbe66ca726fa24aa67c884f1b189d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5c41825977727a50c3962e059a6c7ac4c
SHA1dc43d48e2d5e34f1ccc9cc909a6e23f681b84fab
SHA2561fb81bdf9420073d8a5bed14ff7efa83fe17abcf2176a53de704ac44a3715e7b
SHA51281ee1502d4062c8bfd6998df693d5f906aa435dd2d2dd3dba2062fcad1a071a0122744ad2e2ea5419616d97009a5bb00f4a724a03daa902465a81ac056f5dcb9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB