Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
13-05-2024 20:33
General
-
Target
2024-05-13_aa3c71cedc330ff6eaaf9f288bf9cbff_cryptolocker.exe
-
Size
69KB
-
MD5
aa3c71cedc330ff6eaaf9f288bf9cbff
-
SHA1
b9ef63054676f647001fa6a1ea18cf74ea3ac3eb
-
SHA256
d91ae286545558c6f5c353a45ea63ae608cd21d59ebb24f3eb094930dd5ad493
-
SHA512
6b03ef7e80893e549270c7f5be3b15d2bd7353cd3cff4d340ed80734e5d490aab29c7617654487bc5d329b5c663fdb6392f401c3a2ee9346916437cfe538617d
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1PI:quJu9cvMOtEvwDpjWYTjipvF2bx1PQAI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_aa3c71cedc330ff6eaaf9f288bf9cbff_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_aa3c71cedc330ff6eaaf9f288bf9cbff_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5447e8757548bac711fd3ee1a403d935f
SHA19bb66e0810d79830b52b5f1bed2fac0f77b684db
SHA256e65305421ff4db7d5c3c0425ac5384d40d7a3058d5cda4f6bddf20cf97049e66
SHA512fa1f2682a6da3bb12fbb9a4d1e0536c892ded67773575897254b4495d40dc0a293c95403d80a03080a999988c1f5d184aa583b03ae3f1353eff9bb400e8a0c55
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB