Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05-07-2024 18:51
General
-
Target
2024-07-05_40ef6c83eccb460b89f57b837b4afcbd_cryptolocker.exe
-
Size
53KB
-
MD5
40ef6c83eccb460b89f57b837b4afcbd
-
SHA1
cbfc7ed14c7aabb6b46b054d957282b7dd243869
-
SHA256
b44ebe2e39ab6b6d31f52313e267705dc0206a4e2f959f6464103fcf3f70727b
-
SHA512
20e4ce27370ce0b9be6f184558cd25ba619f86f2b1bffed47c03c662987bb88222d0248729d7dcb83ffc80c8af598b247cab9216a59b619b2011d9069a402db5
-
SSDEEP
768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtO6:bODOw9acifAoc+v9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_40ef6c83eccb460b89f57b837b4afcbd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_40ef6c83eccb460b89f57b837b4afcbd_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD594862b95df9da70f007bc848c77b3465
SHA189da6ad123ead6da14de96b8232361fb214b1ac7
SHA256e96ecf7d318c645baf25ec15d127d80f07ae92a0dfeb4cf178bc4fddabb32ef2
SHA5127c96a8a206bcaea31d6b28a873317283c6583def9a269d5f80e7f9bae914c28b98936b5e387a348e36b1165a961b7506320842f21885abb3dab4ad6a290c02f3
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB