Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25-05-2024 20:13
General
-
Target
2024-05-25_8b50c01381e128724046d5fe15ae0ddf_cryptolocker.exe
-
Size
38KB
-
MD5
8b50c01381e128724046d5fe15ae0ddf
-
SHA1
b9c548e82d1277177cbcc5e381928c402f47038e
-
SHA256
4099f34b18ba04070edb904fcead06fec66d7a52f38f78884ee39a84b11bf81f
-
SHA512
ef9c0ab0c14a689defeb86028487fb2b36653ade68b9591312964d3b1fe6abffdca5c83ee38802c000890e8c35f7b04194b82deec1778b82994e6ec498c138e4
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBsf:qDdFJy3QMOtEvwDpjjWMl7TdI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_8b50c01381e128724046d5fe15ae0ddf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_8b50c01381e128724046d5fe15ae0ddf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5658640c36df850881300b0b19cd4498a
SHA1b67977f8783bbdbaed25e1d1715e7596f11c102c
SHA256be03268eb00e66bd56574b8fcdbfdd2fea6059ec929a2a51ab6787b0896d2c5e
SHA5124b084e4e078e0550b42058cc86137f2de250eee8bb993746f473d64e39221bfc72c78aa15c96b990dbd1f73a865ab85b10845e89b661da92e08f45ba2f630f61
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB