Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21-05-2024 04:45
General
-
Target
2024-05-21_4241a789e1524d2ad2bcfec7daad7e1b_cryptolocker.exe
-
Size
59KB
-
MD5
4241a789e1524d2ad2bcfec7daad7e1b
-
SHA1
bacb702114ef263886958d40cd98e31fef5648c5
-
SHA256
d83ebd78ae09facb06e53549ef923bdeaa671d5ed7b32d7f5677e3b5847c5241
-
SHA512
18a9a23ce1c2f3b92cabbd90e5d4889c6de13284a5c6407aac789dc18ac4d63b05abab416278a5fdd9764af0785269f8051e418abd70e856652e3515e60dbb04
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPjZ:H6QFElP6n+gou9cvMOtEvwDpjCpVX0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_4241a789e1524d2ad2bcfec7daad7e1b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_4241a789e1524d2ad2bcfec7daad7e1b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5de089414cadca7db971f2a329eccbe8f
SHA12007d09730c45168a2246241d6b16f9207941f27
SHA2562941cd30870205d14aca01c7ce51ad79246c624a2fe5bee35bd1b98ee094b6e3
SHA512ed6ee0d57a7972d3d1d36ba156884eb1f6ef107746328a7d456b6e863941a845ee634f00cd2f287ca808de1a6adb777ff840cd60fec7ae2c508aa7510e8d8253
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB