Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14-05-2024 03:27
General
-
Target
2024-05-14_0acfb6da0b323d2e40725e665b182e31_cryptolocker.exe
-
Size
25KB
-
MD5
0acfb6da0b323d2e40725e665b182e31
-
SHA1
f8001dab18c3e3845611cd37aeecfe989b99f520
-
SHA256
3718b3c9ead544fec324fdacef04f0a1778b5d5a150139c51bc0745d20bf4ae5
-
SHA512
2879702fd25d6c917a4fc026f4104cb219f97c5b6e515e0ad719b6490aa9f6c2b97c975cf0fd414cd2ccaac60aa755d15d6eb94382ee9902876bc723d0334f1c
-
SSDEEP
384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6Hnpz:bVCPwFRo6CpwXFXSqQXfjAH9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_0acfb6da0b323d2e40725e665b182e31_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_0acfb6da0b323d2e40725e665b182e31_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD54bb019dfc42990597bcf5496592f3de5
SHA19d5284e0921c17da8f3e04dd39198609d1ec039b
SHA25618a3cdb0838ede981ff177ef9eee870df9b2cca61a5aa37f2131047235d199c8
SHA5121ff4c48e0ce45003f6522d0b6886ab099d5ce9c3f184cae74d6152940a3e994cdb33667ce1ce76bf663f6c9c4df06173ee4dfb3bd4e47e1f6c60da86956e420c
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB