Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14/06/2024, 14:40
General
-
Target
2024-06-14_8db5b853909c48fa743dfbe7251de2e4_cryptolocker.exe
-
Size
91KB
-
MD5
8db5b853909c48fa743dfbe7251de2e4
-
SHA1
eee22d2b6719ec606ef6576f843aed3f6e499408
-
SHA256
5181d57181e6700d07f953c9af75f06fd89451244254d81eb8866e4f18ff1f4c
-
SHA512
9140e53a6abe378989d9d6bbfb7f34f1f7dba4e2212efe0e073e55e52d6910a49c179792a38b80fac0bb26b5c412a80a31ee0f5f6a869f87e35f75935fe4a4be
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddBV:AnBdOOtEvwDpj6zH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_8db5b853909c48fa743dfbe7251de2e4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_8db5b853909c48fa743dfbe7251de2e4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD56a0c930f9d8aea1e82f7237b056c4eb7
SHA1b09ebc2a4bde50a9d805c958e2af0cd36223796f
SHA25692194da85bfeab9fa9b9d7e1c9ae19c94e85c27981ee257d7c1c382cf1ed70a6
SHA51232a6a4970f04984621a7b8f725e01d56010da0b4fe61739154e0d47360b707a275531490f8edb6be8b30c1eddb10de75a6df63cd017e6a4f1a1d36c5bfbe4f4e
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB