Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
24-05-2024 21:45
General
-
Target
2024-05-24_cb623c774f2d31308810a9f06469b77f_cryptolocker.exe
-
Size
90KB
-
MD5
cb623c774f2d31308810a9f06469b77f
-
SHA1
303478e3b97b01970fd9f920e52f3a4e48a0d2f1
-
SHA256
a0e113279489191f2264fd18cf2713bdf6b469c1d9466853cbcf350f3f5f9cc8
-
SHA512
ccac218253505d6acda0dc30d34e1e6f28dd9784e3c6636dcf79b33e95f3adda70a805d3062546d75db6c69627669147f96eb429fb77ad0e2b1fa3aeb0ae8d82
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAyj:n6a+1SEOtEvwDpjYYvQd2PW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb623c774f2d31308810a9f06469b77f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb623c774f2d31308810a9f06469b77f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD50515a20e720ef9122f812ded222fc92c
SHA1dd721c5425e9076da9fac0c6bc2ab6db0915f09a
SHA2568f389dd14d634e023144ee9307b7ac5a10c0c286d7d9f0a04d28f016ce40ff1b
SHA512723aeacbf5c500a5d68a2dc231ca112ec0b4d6896d2fa68327acfc235f3718217653280c1b8aa56a9ef2ecdfca8fdb189673188e4de843f688d2dd60ce096c89
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB