Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
16-05-2024 06:45
General
-
Target
2024-05-16_48dfd8d9e2c257ed8b16727301d0f8a4_cryptolocker.exe
-
Size
91KB
-
MD5
48dfd8d9e2c257ed8b16727301d0f8a4
-
SHA1
6959bac982bb169aae105096cf99ab45e0fc6e8b
-
SHA256
a22b454f1c644cf932b3406c4b9fa3309956a58df0f6725f2ddce55d4af1cb60
-
SHA512
6dcc6d929d5c3220eb163605fa785d7f6c32a9ded9ac497c6637c81feda4c284de87fbbcd7a071260b3dfd8363ba329ec78f7359d872a1769b6b7ddadc77cf7c
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddjE:AnBdOOtEvwDpj6zs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_48dfd8d9e2c257ed8b16727301d0f8a4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_48dfd8d9e2c257ed8b16727301d0f8a4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD511b1f5a320aa7c20b4d98e97bc9ee954
SHA1e6e1420d8065ae66ef22b96a0fc9b208e57a443d
SHA2561494f24e33ce8069007c9fe02d212be14723cfdba17e28004dc3ef2cb1c7dc0c
SHA5125893503001ac5790b45a7fe616106db32bb730da8228b69ab81d0d2009c200261ba3562a1bff9d76e92e06e0fd4b3479047918314cf2ccacd06ae980d6f85184
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB