Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14/06/2024, 08:06
General
-
Target
2024-06-14_bf35150f94a2e99ab3f788cceaedd221_cryptolocker.exe
-
Size
41KB
-
MD5
bf35150f94a2e99ab3f788cceaedd221
-
SHA1
78be1973e23c86b2b1d19ec0d554abcd1a3cba77
-
SHA256
11fb70a5ead51c2279c5a9512a9ed2e5e2d8a76c1cae1ce99ec7dd16cd0d0895
-
SHA512
22f3db098a96e14ca2fbbed8f387e01288809e673f4fd15e0a89c0770a46f9a03a50afc5d152cd2efb5da82c961cdb5b32c09e74a4975695ce61fadf7343f054
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYfg:qDdFJy3QMOtEvwDpjjWMl7TYg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_bf35150f94a2e99ab3f788cceaedd221_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_bf35150f94a2e99ab3f788cceaedd221_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD58e38ff5eec12b0264acf2db26c825122
SHA1c805b473ff24e029e6ce24189866e4c6756a5c5d
SHA25656afc943e1630972a7995511e8ad942d7faac1dbdb1527cc5c4efed09d2d8c3d
SHA512c7cdf35a2bff4a3d26391ede4e0a9f16fd26949d94c60cf6b0b9c1456ce42b6e3a553a1e6cd8d8b208bb61b2216d57fbb2e0afc1dc8689e4904aec43f3af24c8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB