Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
08-06-2024 04:48
General
-
Target
2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe
-
Size
60KB
-
MD5
50f1607cfa5f90fe605d50fe9ffbb2b3
-
SHA1
dbbe62cb545d1580620bcaa187a9bac37bdaef3a
-
SHA256
85a2e9adc4337274af4895d689666065efaa0601304c4ae7d73967ca560b52d5
-
SHA512
bcd22cb4a2d80ed341557c8ce83eed02ceff7d272e630391093d965f48a2f3454dbb36bedbf91b2139d990fc86d39db00061453543af21cd9b68d6529e30727f
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP6p7:H6QFElP6n+gou9cvMOtEvwDpjCpVXV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD55e25f34017d0aaa281755a9d293eac3c
SHA11d425eaab27931271d6a6bf37832b9e253854eba
SHA256142a147b3a1a2230d13773ca0b69428f860ccacff0bb1381fe7bf41da6d12e71
SHA512294edf1f8aa80b0d390154880f5ceaed2c4a62a91291156e56d38530faf6e038dd3039149f2a3265e93751a551dd60c23f377c02e28adf6582ad8873e75a60ec
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB