Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/05/2024, 07:47
General
-
Target
2024-05-12_a5e1f58e706358321e605ae12e66001f_cryptolocker.exe
-
Size
65KB
-
MD5
a5e1f58e706358321e605ae12e66001f
-
SHA1
e1ff9fabe81a993bfd8b7298ce7348fee8a625a0
-
SHA256
d3843167d50339ef59de24ee4f2744d1bb5d787fb49fa3398f28589f89a42c0c
-
SHA512
8a6e552c15d7f3faac2b2390a5bd8ee1de999d3c6e4b12d5e3effbe78dc34893895c63f7e38a60f3eeb7b2aa2cf343e4d78baf75386dbb5c134de10074bff91b
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UAXD:1nK6a+qdOOtEvwDpjD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_a5e1f58e706358321e605ae12e66001f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_a5e1f58e706358321e605ae12e66001f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5f13a18bef73650caa748d275820942c9
SHA175c62a6fc42bb23e340102ade4ebdff661d748ad
SHA25683eefacf1108e3c287e26f12d7098384fbf54d09f049f0c5e87221ca99e2abe2
SHA5120ea35cf2f1cbb7a4e672fe35d40c704802d4f0f64a2508ed23272b150267fb00c4273c2e8d7d3fc7a86e2d86e23a6694d9e9dda91a5558405ba547cda4cc632d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB