Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
09/06/2024, 19:42
General
-
Target
2024-06-09_faf74b848ac2ac184049121fc46c56ea_cryptolocker.exe
-
Size
91KB
-
MD5
faf74b848ac2ac184049121fc46c56ea
-
SHA1
e6d122db0ed8fc4c9c31d7b3a57559c58bd67710
-
SHA256
33a945640a48caecdb7f98f4ed8727ddaa99b3c63949c6606bb913817940fc83
-
SHA512
8dacc937f0f39a35584ed8deb14ba36e65d530fed7cb71dbf031f198d911d0f202fa813aadc5badc71ac2af7fefe0ad98d93e7469499755c2abb46944dc71b8d
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddBB:AnBdOOtEvwDpj6zj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_faf74b848ac2ac184049121fc46c56ea_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_faf74b848ac2ac184049121fc46c56ea_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD51a51366cba495b1751f168dca8b2cbc4
SHA112e6366239695ba2a00c90843afda49f4d51a6e6
SHA2561a513e97d00d63f4fc904136f90a39a5a7535cdde8dd2545e6248a53e33b7c10
SHA512717e93b1978acb4d818e471c1958b54241147aa25066c6541d85815de4082020aa927bfbab271973ca9e3f74e97e35f2214154e7f9445bff067dd97ba4231db5
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB