Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/06/2024, 18:31
General
-
Target
2024-06-09_445a015d0fb6cc926420cbb5d7650577_cryptolocker.exe
-
Size
37KB
-
MD5
445a015d0fb6cc926420cbb5d7650577
-
SHA1
7d7f58f41e37852074dc915a23d5a872e0f841fd
-
SHA256
32948555575f57ae24ae3272400f2f415046607ac1a03de426ea1f0869016cdf
-
SHA512
1468245927ade843c40d9ce408f57d0778a7ff7ed2ce34ece880c43d019543fea243a97bcab7a80481e890eeb0e6aca4799d30b2dcb4ac5742007d09f3fde7d2
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axK3VKLWJ:qUmnpomddpMOtEvwDpjjaYaQQ8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_445a015d0fb6cc926420cbb5d7650577_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_445a015d0fb6cc926420cbb5d7650577_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD555b7a13aca263f294f694e8d98ad346d
SHA1e53d9ff02b20bac81a963c5feee7a2fb5758a395
SHA256f6ec6d4ad4a3350fde6bc51d344b2815e4d8462088aa82e2760d0be842919c42
SHA512a68c2f593aec04356b677d2ff1b0f5c4aea815a56d196a17d4368eb2d09befb0ed0556cb46b2b251d4625075deb9347f245f320b18576262d86cde9c6ebb12b2
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB