Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 19:43
General
-
Target
2024-05-31_e225a19553bd5401f29173f24abdb5cf_cryptolocker.exe
-
Size
91KB
-
MD5
e225a19553bd5401f29173f24abdb5cf
-
SHA1
6a85d17f70b9a26f6119a126cfa8671d09ddb89a
-
SHA256
a5f8ea1ce76f5a5340d17a6445b4f14e426057d086a426aacd0c660f04639add
-
SHA512
8dda0612ca176f7d84b31fe85a85a0631ee1d7ca3863041197b08f053f118e6d43512cd1990e817806076cbbeebf62e471fd309954ba3c1bbfcc159c163852fd
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddAz:AnBdOOtEvwDpj6zo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_e225a19553bd5401f29173f24abdb5cf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_e225a19553bd5401f29173f24abdb5cf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5b534c3ebd0285fffaa4e00aa366b4976
SHA159378afd18119c20ddef273dca892cc707dcbc8d
SHA2567dbf11b669277e28c26eabfe6f3d9da7fc322e0f07314c2b409ff51ea971b8d4
SHA5128353094f29fdbc24486b0c7a5743d480ca8e415779e1d41b3bc1c98c372e9869702ecb236db9d35da44999825b15aa6df6ca4f206ecefb389ed6502f3504261f
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB