Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-06-2024 04:20
General
-
Target
2024-06-09_edb57535181a18d2d1ee13429964c9f1_cryptolocker.exe
-
Size
40KB
-
MD5
edb57535181a18d2d1ee13429964c9f1
-
SHA1
d8df49732c10cfbc304e573ac1e71d6b8ae77bb9
-
SHA256
97742eeab2c0edfe401c71ee10acfc4edc4eba231aa959a61b67e647666b43de
-
SHA512
39dd7b8d1a21c916fe903654c2cc91289c9d421a9894b5d1780143a7de4cbffc0617840ec8e299944ada203efe02990055301d9332b19dc5b23cacb9d7808501
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9hk:qDdFJy3QMOtEvwDpjjWMl7Td
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_edb57535181a18d2d1ee13429964c9f1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_edb57535181a18d2d1ee13429964c9f1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD503c12bb7d9b6051c473c87a96aecb5bd
SHA17aba9aa0e3e077c8f001f718f0245ee343cde3a4
SHA256255c72a07e942a9dadc06376713180c320286c5931ad6f277249441b75406626
SHA512edb82edc8c912abac54a1b8cf2fc2396bc45473a49aa3715f9397c4eba4cac6f663677e47ef3e25bfa650e93e4e0b36028e129e1dc6b84b692f253c35f038700
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB