Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21/05/2024, 17:36
General
-
Target
2024-05-21_d1b5da6808800977c5c7d4d96100ad44_cryptolocker.exe
-
Size
90KB
-
MD5
d1b5da6808800977c5c7d4d96100ad44
-
SHA1
b3e0f556dd669e70c14f6caa52cbc5d283876782
-
SHA256
850b5591a98e5765ebc3b16de5cbab711795c827c171e9adb9dfa64ae1f39759
-
SHA512
569a8aa9a835116c94e93bcb026790df29f762f8e79dd0dc3216643779e39cf49d38a9582e3668b3923f63707f63878e02d8a628d85232434833dbd95ac519b2
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgIiE:AnBdOOtEvwDpj6zG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_d1b5da6808800977c5c7d4d96100ad44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_d1b5da6808800977c5c7d4d96100ad44_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5d105d66af41f1ed3a3b1ab97d8d69464
SHA1673fda6726c4da3a0922328f57204b1a2b6e81a3
SHA25621772805c2390e034cbaaa39d4ea3d21994d3b6f1e164e17e5c8eb2def3ce409
SHA512d60a941a0052a79186285b145e5c5349afbfffc08321ce71c3baf0fce7428bdba902ed02113d1d1926b216cd764ecab4bfaeb061ae3e57b75e799e620220fd75
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB