Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/05/2024, 22:26
General
-
Target
2024-05-20_7d8eed29f8b197b15a3f5e207c721a70_cryptolocker.exe
-
Size
58KB
-
MD5
7d8eed29f8b197b15a3f5e207c721a70
-
SHA1
5f85be9d2985e1a9196fcd728e0d84792b693707
-
SHA256
2d3e03335b0944876f60a576e7950a716fbf8517b80edc93a313600df86365eb
-
SHA512
90f8a9b9162476984e71741ad3512254a53b0f265382058f1a1a69707dcd943d325d4f15825a20a2bdd44b110e389aa153bc60348e2d39053fa6ec3360f5a3ea
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5appu:z6QFElP6n+gKmddpMOtEvwDpj9aYa+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_7d8eed29f8b197b15a3f5e207c721a70_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_7d8eed29f8b197b15a3f5e207c721a70_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5412506086f2326d996c471653ae1b07e
SHA16953c2ec80fe75fc543dacb2104d71ff8ad33dd4
SHA256b39e7182409556fc71762e3ac5d98663209186f79e2188b3b77b6fa5a8275f8e
SHA512c709c49c6c004bbe1ff5000bf2228c8b037f68824d4cb326e21cb34672485a7de93f63a1ed493e95b532430c47472bd2388dd26ee281125692f296e6b716aab0
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB