Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
13-05-2024 07:38
General
-
Target
2024-05-13_b979e617379881c940c77e8b9a44cc5d_cryptolocker.exe
-
Size
39KB
-
MD5
b979e617379881c940c77e8b9a44cc5d
-
SHA1
7d4b8462294e278566a7ff5ef605850a0db871c3
-
SHA256
2517173f24a9bee4eeb1e8c483cd66c765e343b6446499b9b88e48cdd432e55b
-
SHA512
1691dee8189283a39626415f9022e1bbaf9113307fd9d13357a069838d9b229a1ef10b649827f8c02b93cdc3d462c5e22341f722571883f0d2200d0a7d838fc6
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBG:qDdFJy3QMOtEvwDpjjWMl7Td8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_b979e617379881c940c77e8b9a44cc5d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_b979e617379881c940c77e8b9a44cc5d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD548d9781a9ba4191f83cc32d81579fec0
SHA14baaafa4d582a30d3465a5d4ece74550c8b43085
SHA2562c994b745aae397807b63cf4312da3bc60faa00c0083e31346c994b95ed9b220
SHA512e66eec26cb2bb59569ce50ab52ec4dd42cd270a2742fce920391387a1c5d54a03d38e28ff823cf62a64e5761346cd804a5b1c4a8bf9e106b4dc3ea37e19e045e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB