Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30/05/2024, 23:14
General
-
Target
2024-05-30_b265fba8f9dfa0215fb81866fc4a23df_cryptolocker.exe
-
Size
40KB
-
MD5
b265fba8f9dfa0215fb81866fc4a23df
-
SHA1
a62c15d2bc8bad89ec15a7da87a963ba3e4a59d0
-
SHA256
284dda494e3ff600a0dfa306a3d147dbcc6184765ab76d1375f6019725efc728
-
SHA512
2301daa1b1640d15a533d9a13abfe1d917026cbc385b97a0eca47af1e3ad9ebafb21c274cbf84fc55d490f9ee428d032787fe150b7b642b91acd8bc38310a230
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBc8:qDdFJy3QMOtEvwDpjjWMl7Tdb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_b265fba8f9dfa0215fb81866fc4a23df_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_b265fba8f9dfa0215fb81866fc4a23df_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD58e971ac48c8458e26edb3d12691fb190
SHA118216566b93a61252beed448ef9e1a77c5687408
SHA2569deb0cd8103704ecbde4d409a45c4755c1a99f2ef67b8ebbc56e926a7d754fdb
SHA512c067116013685cd1bd457be483196d13266ffca9244599249f54f3b677dcfd1f7cc0df9e16f2cd0fb905b2aba9be043332b88595688e197434af2d4531e1e1cd
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB