Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
11-05-2024 23:24
General
-
Target
2024-05-11_3491fbef33009822fb6ea506d5b40e4e_cryptolocker.exe
-
Size
38KB
-
MD5
3491fbef33009822fb6ea506d5b40e4e
-
SHA1
e884a000548ee0edb35308b97ec38b2bfbc1c1fd
-
SHA256
f257f114143f09fde550c049c3ed07e73a42f469297b3070550088f9f5b3f999
-
SHA512
35f18d62e66f78a3f5ca6e462bdfb015c1df39a07b6896e16b21bebc00a1bc373d2251e5b308a2dbaee74c2ea118a2326bd2476c789d44a8d49e0c7ea7e2769a
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBd:qDdFJy3QMOtEvwDpjjWMl7Tdr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_3491fbef33009822fb6ea506d5b40e4e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_3491fbef33009822fb6ea506d5b40e4e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD548d00c7796993d4bd4c91d45c4ad8758
SHA1093e8bff0d53bc6385a14d0048c69217c5729335
SHA256343ce53493cbd3728b1f5a60ad7a31753d799faa45a63c942715e79f4e3cb77d
SHA51264cc8530513461fe87dd976a92407209f19a6a742f65ac9a98527e676fc8c16572f6a50b9fdf706c63ffa2c7e09fe7cda547b35cb0145bee08aca902c32fb225
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB