Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/05/2024, 09:30
General
-
Target
2024-05-12_7d4f5d9c069cdf9fa396af0e00e13894_cryptolocker.exe
-
Size
37KB
-
MD5
7d4f5d9c069cdf9fa396af0e00e13894
-
SHA1
7e73ceadf8fcc1cbae7e6125a23a416194cb585e
-
SHA256
591fa5b98bf531b242f71291772d93a23abe3e7ee933653335ffdd917f10b732
-
SHA512
ec33baa8461a89ac112670111cb3cc8402c3d7b18e9f4be3767faa09215188be08ea3f0de08e90842e8e3248b4f2fbb0306c7a199fe609bae00cc0e12985735f
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axK3W:qUmnpomddpMOtEvwDpjjaYaQW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_7d4f5d9c069cdf9fa396af0e00e13894_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_7d4f5d9c069cdf9fa396af0e00e13894_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5af977a4c795b410ab56c18d7b6b069bc
SHA1b0c866a66b5034ee20e9f0afae296bcf968dfe8d
SHA2569d6c9eaff34b52aa8b6cf87a007e8e3fd9e7434295acf2a2846338e8992c9d65
SHA5122751b98456edd6287f95a518cc6d7ea477ca3f3ab45ac81de2ee5f0b8999540d6898b3c894d54ec94fbd6d42a36a56db044b10b59fb38410f67b1f8619a99175
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB