Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
04/06/2024, 23:23
General
-
Target
2024-06-04_161654073bc83b812696413247e09469_cryptolocker.exe
-
Size
64KB
-
MD5
161654073bc83b812696413247e09469
-
SHA1
b1d106cd316da8ed823843c10b83f84fd2621fa4
-
SHA256
101a267cdd66cbf2025b1ee8a5eecfb8ca6b174625f589003d42aa779427fd20
-
SHA512
36246a6a543158b5231857403fd96ec8a6767d0762c2db3481f36c8b98e34ac69c9105a95b80f8921aea17be2d44d4afc58a7c508f61789d36e939b667009f03
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYMWR93:1nK6a+qdOOtEvwDpj4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_161654073bc83b812696413247e09469_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_161654073bc83b812696413247e09469_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD569b117f07376bac1ad478f6b9a1760ec
SHA16114389c76099ecb02acdb509155d48a121e0c64
SHA2569a4b360ae2c128e459602054d4671c27af566c93442086f5c5e2e446d9cfc1e6
SHA5123f6cf24cc77d840e8f93cd4d310394cc4cb63e702dc415e33c60d9e518b401cc0d15ea9b68a5fbe5eb969001d289f010f0ab9824c06ced9a6a9ee4999ad0bb6a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB