Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
03/05/2024, 07:32
General
-
Target
2024-05-03_f266bd4620bb1e098dbd7eacfbbf0cc5_cryptolocker.exe
-
Size
38KB
-
MD5
f266bd4620bb1e098dbd7eacfbbf0cc5
-
SHA1
817745bb793bea097387ebaf3f7f6ac77e44b88f
-
SHA256
993241541a323ddf23a084790792116ae145dffce41394288adab5dc1d5a9087
-
SHA512
97f50cba5588e7c2e1f374151098a350c47d499740053ab6dcb5c0961a65225e08de88a9b189e7e9ac60e93c3146e6453e6812d9027f3347b2b3f250167b54be
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYB:qDdFJy3QMOtEvwDpjjWMl7Ts
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-03_f266bd4620bb1e098dbd7eacfbbf0cc5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-03_f266bd4620bb1e098dbd7eacfbbf0cc5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5f0a9b4c1a1f92dc430be2f463548a67d
SHA17fd4664cb75b7aac8e4b3e932c08922ea140129c
SHA2564ecb6cc62061ba5157529693db751bb5eb0ec88c139963ecc9f120c9ec920d89
SHA51280185b71b0a12e5c3487fcbbb8260f2ce16e415c8208cb157f8ce07fd966ee66fc69e7673ca51d3cf3fe50c60becd98d1edde73ba95806510fab1c7b138985bc
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB