Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29-05-2024 04:36
General
-
Target
2024-05-29_aa71597e3dbeb4accf35ac989307f8b9_cryptolocker.exe
-
Size
95KB
-
MD5
aa71597e3dbeb4accf35ac989307f8b9
-
SHA1
43e63c09d325ae2cf9c142651b21c2db3cd4391c
-
SHA256
a97c3e527f4fa0465ad13ae5eae6d07be0a6ccc4350cdb9d1f61b850b9f795d9
-
SHA512
95f41ebcdac886b6f34b231f8de887216764b5e862f760a575cd99b02e531db2f0c5b7cd585b2b0cbc899d197513a0abe343c0c56f799e8b8595e4797875c03c
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp0+S:AnBdOOtEvwDpj6z1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_aa71597e3dbeb4accf35ac989307f8b9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_aa71597e3dbeb4accf35ac989307f8b9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD598c9ca1e369af5b1cfe0eac14026470d
SHA124b5a64afa895bed33cb9ddae0656e709a1aed1c
SHA256f85e9aaf0cafce339c00a250d458d2ad4e44def0fe6f261708e8cb4da945cdbb
SHA5122fd52c4f0e7d8c438fb9c5a293574332180f60cf76491970deb9f46653746fb603341b7fe183a467bdfae0dd82df78e26d379947ccb3cbe47cb67cb4a3d598c9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB