Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23-07-2024 09:54
General
-
Target
2024-07-23_c08bb952ef9e8613c39341cbf99316c1_cryptolocker.exe
-
Size
60KB
-
MD5
c08bb952ef9e8613c39341cbf99316c1
-
SHA1
100de3aad3d4dac42ba490d6aba6d0b320303dc7
-
SHA256
43206a2310afefa27c7665bc6b1d900eae798599a9f21d10e8ad65529786f501
-
SHA512
3e707de1d885c7c839e5d913a08808ead680902f7b57627860508b4f677ef0faac079a554d0d388a86f3de83656773ccc66e345bbc371a6a2a7cccc6e23a1d48
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUFHq:T6a+rdOOtEvwDpjN+K
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_c08bb952ef9e8613c39341cbf99316c1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_c08bb952ef9e8613c39341cbf99316c1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD57203c108a2328983210359be900388e7
SHA1c289a653afdde2a89d46965cb7202e681469092a
SHA256e98ffc49b1ddcc7f297fb74c9c111d8e0b533040e64d64681cde8d60ea13c477
SHA51219b137ceb1e25f2c6c471753260d679853201189bd5da828dbcfc8c3995ec60b5f72b934a541c64cda24f23b20b3bce93c5b10ca0be58a11b3839968df679928
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB