Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-05-2024 04:37
General
-
Target
2024-05-11_47985eebebddb0bfb5e12080c66642d2_cryptolocker.exe
-
Size
39KB
-
MD5
47985eebebddb0bfb5e12080c66642d2
-
SHA1
667ec5daf2a6f30ee992cbb34230e464396f22d0
-
SHA256
e079abca626b7138e12e2496a1510308770e4454c300b7be1af4deaa7b4dc5d6
-
SHA512
fcda83a5116947f1215c64fb81952f9e8391de60b1facd53ed0202ae25c41bc19a41b67a1d106b6811fb0dc78ff5af6b70a43ef152fece51bbe700756b154aed
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9iSn:qDdFJy3QMOtEvwDpjjWMl7TA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_47985eebebddb0bfb5e12080c66642d2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_47985eebebddb0bfb5e12080c66642d2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD505d9558697dded984ac40d9c143c79be
SHA17290f4a7bb3877d87a818016fff5b0de53df6903
SHA25637751241395330d013f848914f0e42f186c71099d4ff1b797c58320344746105
SHA512eec57ac993078693336c4f3ba82f11844b05b5109c7e534d2dcfbb82ea7d243b4f399b2e369a6d2cc0e76a5e2f9c993bc31e1c49f7fd6d7df2d01353d095c1c5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB