Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22/05/2024, 02:40
General
-
Target
2024-05-22_ef29eec03e194942892863a026a6f57d_cryptolocker.exe
-
Size
79KB
-
MD5
ef29eec03e194942892863a026a6f57d
-
SHA1
89f7dfcd5a1b016aa36fa1af7c9617d5e0813ca3
-
SHA256
fe4093e0e4d091043abcc46617d68d2cd983295d5c7c24b2b2eee1ca41b0a477
-
SHA512
c947666bbd56ff01d4b3a3b40f1f3b158fe2a5b75cb19e0c746939bc3015812c96d7a973f43ed566c1f7907c0a002d591a7eca5decce47ecf8ccb1680f363571
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdJcRk:T6a+rdOOtEvwDpjNtp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ef29eec03e194942892863a026a6f57d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ef29eec03e194942892863a026a6f57d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5fc7908375b7bdbf9b5aa127c2e96c17e
SHA1c4e4cb34f06d65d5569588565b636ff16c27dd22
SHA25602990a969d694d621f582a804dd01a3635c69ba278b00857ac85c7b69ad47cdc
SHA512c0255c0a3aef8355fda94c0a38e2acf5c567bea9c8027ec38ecb32b4f8a609fa868a2b69705d768482954a63753521e6ecf787f81533a110dd4d783d43b20e68
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB