Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
17/05/2024, 16:47
General
-
Target
2024-05-17_aef78f46044d7cd4000c244e07cb0e91_cryptolocker.exe
-
Size
25KB
-
MD5
aef78f46044d7cd4000c244e07cb0e91
-
SHA1
6f91ce25fc3a7888d7ca1b78428f760c77f6c5e8
-
SHA256
67e186e160b03e8b473a6099bbdc15453e697d5b3c2895d01451d3b94b085160
-
SHA512
a566886eff4edb6dc88dd3571dd1a66759d8b110c9739f1851f04bc08e3613c9120b5e77e796543febc57b3f810d9b21daccf18c4dae97e6ee0b31fce829f37f
-
SSDEEP
384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HnpObd:bVCPwFRo6CpwXFXSqQXfjAHAp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_aef78f46044d7cd4000c244e07cb0e91_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_aef78f46044d7cd4000c244e07cb0e91_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD59d0ef089bfb840e5b4a0d4ecf8d11904
SHA172271c0045c1609dfc61e6b48dfb049157592e63
SHA256e26464d53ce9a2d5b53146438156ffeb1a7761b28ce624af63dacdf8ce3db31a
SHA512ce5863424df887a1f55fe8d4d202f6655a107d0678ff049939cd64522ca5abdc6cc8a394044e3af8dbd9d4554bc9fdc0934e1a96624f4d5d71029cb041efc2a2
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB