Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23/05/2024, 19:28
General
-
Target
2024-05-23_57600378503852ddde615c726388f5e4_cryptolocker.exe
-
Size
91KB
-
MD5
57600378503852ddde615c726388f5e4
-
SHA1
41499946d8b613fd199e5f589a767ee05cde3850
-
SHA256
c758da64f12bda44871919391482238ee57e34006eef236c06c9bf579bacee2f
-
SHA512
c4d681cef0fbdc2f06567c4c1af43294acf16a6a1bca774cc1a413ef21d66b4d03c032b2ac052310faf102a744d6c89f6994a6d48daf1d886899e230b968084d
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/DD:n6a+1SEOtEvwDpjYYvQd2Pw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_57600378503852ddde615c726388f5e4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_57600378503852ddde615c726388f5e4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD54bcc5a73a5c30eeb931ce456b7e8dd1d
SHA124e162c2a1a0f5b87f083b59f94d760db7c0ec8f
SHA2566155f49666475564976a5ba6931e37c12597cb6727ecf1c22760051fda2a5f1f
SHA5126eaa3faa7319f3c0eb700554c09ac0063c21a2f37a99841633a784872c27929dc4cb8f1943cb5accb62bc37de9a737caf8d9c6d3429f7b625e9e97082dd07802
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB