Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29-05-2024 19:32
General
-
Target
2024-05-29_c722dd3046851e971d7937220e998ef5_cryptolocker.exe
-
Size
40KB
-
MD5
c722dd3046851e971d7937220e998ef5
-
SHA1
8c58172fb15c957126cd9e4842fa331fc8343755
-
SHA256
33ab333feb99bfe70e29646243b13d5fb6ce4dd09eded018306ce6ef37f186af
-
SHA512
97baa85a45b10f0f8cf7b19c9b1d0d054433b5a5a4d1770f56d71a4539433d840a8e3c8c91f7fd09d8d593112904af67ffd5a04e74abacf1abeea151ccd49ea5
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYf:qDdFJy3QMOtEvwDpjjWMl7Tu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_c722dd3046851e971d7937220e998ef5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_c722dd3046851e971d7937220e998ef5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD563c54b50cb45e728f41a5f2d736cc18c
SHA11dbe2ba31e547b054672ad0125a8772d890069b2
SHA25625d77970cec4216a7f8f9157090c5b25437a655e832da06e973e3b16320b3dee
SHA512e710092cc778a5648317421fcdd7561582dc104b6f443eaea52a94f8e0a1c0d4c53ebd7724a9dfaa8687bc207d92ffcbaf4ffb049c2060151ecf5701c3e65ec8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB