Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/03/2024, 04:34
General
-
Target
2024-03-09_4f6e8ae64f5006e29e94b922230403e1_cryptolocker.exe
-
Size
48KB
-
MD5
4f6e8ae64f5006e29e94b922230403e1
-
SHA1
caeace6b823cb2a1157244105615e9057dd0d855
-
SHA256
387b75a4e7d4080f0bf4b1e3b759c1098d99d56917bd2f15448cf6beaca03e65
-
SHA512
f05ce926e44da2a3da452ff1e6bc2f9eff89f12730e8ff76e9ade4e5627d877f845c56078d466b49ded6f06a35bf52c9eee9726697dbb710317e00d0c96c6bd6
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1Jb:z6QFElP6n+gKmddpMOtEvwDpj3X
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_4f6e8ae64f5006e29e94b922230403e1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_4f6e8ae64f5006e29e94b922230403e1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD50026a7c9bd60dc4c3a5bd979902b12b3
SHA1da536d13c4fddc41fe20f47f9296ff6a933c4183
SHA25658ff7b66f7fb34ca242f213c169acf89cba0dd21089e16b7af0f836294197d89
SHA5122acd737ed3b2efd3b3c2a2027d3df7d4054a82be231f6d4ac099c6ea5d93337575f60ac5a4b8e9900b64c7ecf87039adf19b399038443b5c429d7bb708bd02ba
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB