Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 14:39
General
-
Target
2024-05-22_3f3db565d7d1823c8fdc5d7134821808_cryptolocker.exe
-
Size
39KB
-
MD5
3f3db565d7d1823c8fdc5d7134821808
-
SHA1
4bd56244cacb3660b76ef17e57d2cee538311633
-
SHA256
9d181653eca1f662a62603306ef8ffb178fe6ee7cf0ea7cd1adb55301acd851e
-
SHA512
421ecccbde5a746771ab4bd32dcf157a99dcb3980ad03ac94e187fd777913d3b641be550c1868d8a1cceba2ece940c757467b21d3a4d02e5a1c5c51d16193b30
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9V:qDdFJy3QMOtEvwDpjjWMl7Te
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_3f3db565d7d1823c8fdc5d7134821808_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3f3db565d7d1823c8fdc5d7134821808_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5fac15ff5565c3a2115795bed14d3d304
SHA12c980e9d2121b87a623c0000271b07ba5d20dfd5
SHA256ab9a81c5660ee7decabf5a6a5791edfe5ec718fdfe24db0ab7e5670d3953fc36
SHA5128938667e4b41ed80c609697be99d1378d8713461f384e50750e7ff0e6a2549b62933893b87f7a4649f964351480d698d9784ced9117fc496f4312edafdcfe33e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB