Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
02/06/2024, 20:28
General
-
Target
2024-06-02_4320497fb511abbd6b79645771a4053e_cryptolocker.exe
-
Size
40KB
-
MD5
4320497fb511abbd6b79645771a4053e
-
SHA1
a0060f7197a674510b8adb959ed09d76dd575b81
-
SHA256
9c2fc3e39759ddf3e9af997f50b1d068329a85eefa3d4b399244360b440c2318
-
SHA512
3c97c5af03ce6dad84b2af9d96654bf5d2c9c53c76f780d995b2f9d2d19935c6dfec655cbd95fded4d3be22e7e583b411dc1c40bf2444ca1821705e931f2f185
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYmL:qDdFJy3QMOtEvwDpjjWMl7TV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_4320497fb511abbd6b79645771a4053e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_4320497fb511abbd6b79645771a4053e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5040564c545c04590cebcb52c084b84ee
SHA10e7efcca6bc08cf3a870ce8d7fa9d72421fda0f9
SHA25652155870898091a13b1077d2445c5f8d1b4ed00169d8010da21dc880858771ad
SHA5122e5681661d53138bb9e88be1227e6a137ecb942796f209b95ff6aa06e19df51cb5bcccec8f74a948991fe0299958e581f18678d350bb4369c6f17133c4a9a649
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB