Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/06/2024, 11:50
General
-
Target
2024-06-03_f216070c423924bf42e16f09d0d90247_cryptolocker.exe
-
Size
39KB
-
MD5
f216070c423924bf42e16f09d0d90247
-
SHA1
f0ffee945a152befd0f18c6728fced2ab40ed6be
-
SHA256
49c4a5cbdee9b848e1aa3ee8e3a81a32253e1c3c90aab4eee4283fa6d615a8af
-
SHA512
5ba803d4b40ad098ccc2b6ef8465686f0d23e9b70af9ed6bf255ed3f0a2ebf1df98be53427abf4c11831149bec10f8617f362225642eed07bd35daaf6a2142a4
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYabDB:qDdFJy3QMOtEvwDpjjWMl7TdJ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_f216070c423924bf42e16f09d0d90247_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f216070c423924bf42e16f09d0d90247_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD50237405d06664272ec83708c80d2b4d5
SHA1e6f2ecf17ce9a379097912607de3765da19c17f9
SHA2561906d7946227ad2a7b1995a8845d04f53ffe82a0a6d6329f3d1fc9b635b655de
SHA51207c187fe57fdaf4820ae4edc433e9a2f47b240bc038d0fd149c42dc5fc3280de0fc4e98e5f87be772e4d68d0c17248156085e425559c8814726e20714715cff0
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB