Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04/06/2024, 05:50
General
-
Target
2024-06-04_c14a3bd4b82919480a9478d2d41924e3_cryptolocker.exe
-
Size
90KB
-
MD5
c14a3bd4b82919480a9478d2d41924e3
-
SHA1
abc2398147a6a1e0d65b97996ca8cf79db9be4ee
-
SHA256
e98997de326ef212073c78aad0206bc2f64d19585533ec44332838cc50c0c049
-
SHA512
ad83619c8f889ee03947373dddff7904b4f98ac9ad10a2b7682ea2a8ba30ec9677ddd5a39d76221a45d13503feeb4416a789feb64a281239ca82d46bd6a0f4a0
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAB:n6a+1SEOtEvwDpjYYvQd2PB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_c14a3bd4b82919480a9478d2d41924e3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_c14a3bd4b82919480a9478d2d41924e3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5bd47ed81bae78bc04792549f37dd62ad
SHA1c1583f852354674ee9484a83133b6d27341b129c
SHA256811d8c140d538a88d3fbd2a7296aab1e7a94e05f642afd175c7b740acf3e01c8
SHA51226a1c0897ee24a6d0abceb1a880e645c3e3ae9531904024ef3a1ab767745c7c1ada9a54f78d15c8c1eb91db7d360f453ac137c8ae2523653a8bafc5298809d61
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB