Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 21:08
General
-
Target
2024-05-23_7ca5acf262d0b3c77ed9dd84a0c89e85_cryptolocker.exe
-
Size
40KB
-
MD5
7ca5acf262d0b3c77ed9dd84a0c89e85
-
SHA1
f0fc71b92d8677d214dfb0f675b4f3d27bff5462
-
SHA256
2acb3e173c635cf1adb8cb0dbd3ef562800aa713b77bce69960e39d84b6d4916
-
SHA512
a64085db74687fcc8cbd72530f67866c899df84fc32f0441c70178dfaa72a2f939371f734421ce23b212533372fc5947e45f6ca7a734a5a5165d2813eb37c30d
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYoq:qDdFJy3QMOtEvwDpjjWMl7Tlq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7ca5acf262d0b3c77ed9dd84a0c89e85_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_7ca5acf262d0b3c77ed9dd84a0c89e85_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a193056f526fb0900cc4e6008e22f8c4
SHA1038c55ef187910eb1593314bcb1bcc7408d50d1f
SHA2563029e876cf760bc7da1dc5cb7beeb226240d5aaed8738a76152d9cfe956943c4
SHA512cba67ec422ea1bb07a1e2271e273f378e3215ffbedb2e96d4fb9f2498fe6f7d3e4d9208e4c08b5cc32c32f19696cdd65291f13653d1cc8e751c223b8e058ca81
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB