Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16-06-2024 14:32
General
-
Target
2024-06-16_8d092c6c9946b687db09ec894813eed3_cryptolocker.exe
-
Size
41KB
-
MD5
8d092c6c9946b687db09ec894813eed3
-
SHA1
ebeeaa4e4216535d7ab9cf06f238824057f6bf02
-
SHA256
8f7e8810121b11948c5a2ec578907c78329aa95a7967bdf43604e283522bc4a7
-
SHA512
d7fa1688f32d977f93cf0ac033afffb918d2b3d68c379714277004388dccb7aaec64e1f41c922466805fb37d958c94561ac8522f44fb8cee5bab07026967aaad
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYL:qDdFJy3QMOtEvwDpjjWMl7TS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_8d092c6c9946b687db09ec894813eed3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_8d092c6c9946b687db09ec894813eed3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f2d6ee42635d8741c99e8a1f5e7d62bb
SHA1d398bf6d917e8588ac68b0d8a9815a38018da1b8
SHA256dd53f991ce3c32f2cdfe6cdd3dcb97d0d637858e927ce07913023b51df091c84
SHA512516cd531d74a3c5a818a6b88111be2368c468606b27cf0692879d906fe00c8acb7805b4f89a7729406b09fea89f2309e97f2fc243d9951ff53302b0e6cd49ad5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB