Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
13/05/2024, 15:24
General
-
Target
2024-05-13_43b52c8bf90b71594b3265f9ea3ccc30_cryptolocker.exe
-
Size
90KB
-
MD5
43b52c8bf90b71594b3265f9ea3ccc30
-
SHA1
5a6caf73e6e987b23dad1f77bcb8270ff37e5adb
-
SHA256
86290194704d21367ab44cc4b49f00c3c2143e2b3582bf0d73e6fc5dab0bd52c
-
SHA512
ccb17f49c62ce58e3ca39de75914bc215389fb34d69a5dc5b7d3d7b02ea71291a1a9cada4bcf184fbfaed4d30bab4f939d6738d59ddec316e91701f39641bac6
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgIi2:AnBdOOtEvwDpj6zk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_43b52c8bf90b71594b3265f9ea3ccc30_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_43b52c8bf90b71594b3265f9ea3ccc30_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD588bc40e994954f703158d823aaf0f2a8
SHA19cef7063d4da97f9c985ebf5a50b6a1177952ab1
SHA2564e758d6238bc6b524eba7de07bf21832f5f955ff8184d6a2538cb94f0b44c83f
SHA5122ab32b792b18133e380d7392e1c3426d1724044014627ca045e7d314a0f2a5a383c9a6e2d646ffa5c044c90328b36d3bceca70b175dce681e468a911a4c55876
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB