Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 01:11

General

  • Target

    2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe

  • Size

    91KB

  • MD5

    9c4ada962ebdf0f1254afc212c77dd6b

  • SHA1

    adaa1a52cc22be446ba9b936c017be89ff84006d

  • SHA256

    3bb0b983639eb506c05b33dfdec8061b226b3bb6175d559419244634b6949a0e

  • SHA512

    42613b7d8010e7a7e998d455bbe49c1f3a93596164ddcc3c129ab5bc3e0ecc8f5a31f074d0a4bbf6a00c3bdce32e21709a05f69ed3b48debd1d688584d7e8213

  • SSDEEP

    1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAyI:n6a+1SEOtEvwDpjYYvQd2PB

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3948

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          91KB

          MD5

          e5092896f37d580fe522f4e6239a7aae

          SHA1

          7c03b9ec02a6cd97998029b44a6bfb25b5622f04

          SHA256

          379d81c849374ab0f0f02212bb8d44c919cb4a59d22d248c291efbda4f026eaf

          SHA512

          3d59dec7895d28fdecea6c06cd4ecb0bdfc72e76845ecefcc31addaf7ccd568255c4a8087703bc89cd35b70150634f363f2efbad84ab36eba881ed812ecd179a

        • memory/976-0-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/976-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

          Filesize

          24KB

        • memory/976-2-0x0000000002070000-0x0000000002076000-memory.dmp

          Filesize

          24KB

        • memory/976-9-0x00000000005B0000-0x00000000005B6000-memory.dmp

          Filesize

          24KB

        • memory/976-18-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/3948-17-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/3948-20-0x0000000001F60000-0x0000000001F66000-memory.dmp

          Filesize

          24KB

        • memory/3948-26-0x00000000021E0000-0x00000000021E6000-memory.dmp

          Filesize

          24KB

        • memory/3948-27-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB