Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10-06-2024 01:04
General
-
Target
2024-06-10_7d4bf79d63ca7ae65f26e7d2e2bf7cbf_cryptolocker.exe
-
Size
91KB
-
MD5
7d4bf79d63ca7ae65f26e7d2e2bf7cbf
-
SHA1
706c95b98358092d259c6ab8a6ddf266a9d20275
-
SHA256
bf4f7d1777ed679971e92858ce85f4b744cb90dee45774966b40e2d1ea0726ca
-
SHA512
233c8ce6f8581471336c9925d880212d05dbd1f5aad98d5b80502ba061b093477bee534e240ff5e292c1983b8c8a8e1cdc9dfcb23900f5fc981cb48f2b67e40b
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddBD:AnBdOOtEvwDpj6zx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_7d4bf79d63ca7ae65f26e7d2e2bf7cbf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_7d4bf79d63ca7ae65f26e7d2e2bf7cbf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5521cd5015d80305cc9f4f87d39269f3c
SHA11ae03f2017b14527b0d8c6da12d49210fbdfc061
SHA256a7704c452eab620df519e78e3ca37477ab9ce38125ca1b217b82a603cd6ddf60
SHA5122c018d6ad132b6c68b2f469a5bc863b6f9dd7389bd227b88c0fa8100dd3a698a368aab22a6ee4829142cdd64b8afbd09ca45cb59b99875f17a743dddff367d07
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB