Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:32

General

  • Target

    2024-06-09_93c09ea5cb023c1616718babd6c4427d_cryptolocker.exe

  • Size

    71KB

  • MD5

    93c09ea5cb023c1616718babd6c4427d

  • SHA1

    8886503aaabe59761e8bfaebe956c71bedab8d63

  • SHA256

    5aa4480175c4d9c03906a1aa5f67655f03a71cc90574430642651ebc078de9f8

  • SHA512

    490df6151e4041454c468e1b636c926f115eb3e82a49d5caa0f63447dabe38d099513ff97ddbeafb854b3d68f40a249c22a1b030f452612f388d726f7cec4dda

  • SSDEEP

    1536:quJu9cvMOtEvwDpjWYTjipvF2bx1PQALz:78SEOtEvwDpjWYvQd2PP

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_93c09ea5cb023c1616718babd6c4427d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_93c09ea5cb023c1616718babd6c4427d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    71KB

    MD5

    b94a2939730bddcc3d27e84ab3952d92

    SHA1

    926b21a23054202aacd465a545068355b4c00e9a

    SHA256

    ed8eb2d33d336273f3b954b87ef2c27a5a79534d7eca2bab793737bca3c2466a

    SHA512

    967d8da0a2ec50b1a4a555043071e4b2b640ce52fe8306f2809a5938f3a10127ff3ecfd00fe50f0bed3d0bc885d672849b8dfa48b53b9935b4cf8bc7fbe5a90b

  • memory/2248-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2248-1-0x0000000002140000-0x0000000002146000-memory.dmp

    Filesize

    24KB

  • memory/2248-2-0x0000000002060000-0x0000000002066000-memory.dmp

    Filesize

    24KB

  • memory/2248-9-0x0000000002140000-0x0000000002146000-memory.dmp

    Filesize

    24KB

  • memory/2248-18-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3148-19-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3148-21-0x00000000007D0000-0x00000000007D6000-memory.dmp

    Filesize

    24KB

  • memory/3148-27-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB

  • memory/3148-28-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB