Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
13/06/2024, 05:28
General
-
Target
2024-06-13_5a66d93018fecabff7b2c2c26d3c9a5d_cryptolocker.exe
-
Size
40KB
-
MD5
5a66d93018fecabff7b2c2c26d3c9a5d
-
SHA1
2cd654c223f77a333708e78a9a908323ba309316
-
SHA256
e9d43a1bf9c2941cf90122340f60de2472820e7076b44822154fbb02cd313112
-
SHA512
7a2cdfc1c31430c2c5b4fcfec00d2e1fd6a67d600ef91c404a61a6dd648e9d922d6abc17550e02592517f0a33e7fd5e461c23a4f9b1a39add33f202dbceac818
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYabDbz:qDdFJy3QMOtEvwDpjjWMl7Td/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_5a66d93018fecabff7b2c2c26d3c9a5d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_5a66d93018fecabff7b2c2c26d3c9a5d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5c0ded0c35e70bca1d7294177cf2def92
SHA19417e357f6928f8581b99857a328b08853d21fe4
SHA256940c76bb7ad68b40920de5a77acb2b217eb069fdacd2f04a463271db05d1f791
SHA512d98fb84260e323c188c537f2d22d70408cd46dbeb87c84ec5e8f19331a14b2c3740c9974e303c5335c496927c0a7a5b7c323a81c266ba4b2a331648ea81bc502
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB