Analysis
-
max time kernel
164s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 09:36
General
-
Target
2024-03-13_49e84d6bbe341bc17a7fbabeabc36f34_cryptolocker.exe
-
Size
83KB
-
MD5
49e84d6bbe341bc17a7fbabeabc36f34
-
SHA1
865547541191f967e089fc1c3cebda4d5cadd349
-
SHA256
0b714946d9f8d539337c0232073782518b081ace210ca90fdb40fb903849af29
-
SHA512
16362f0644db8747a31e3701040016626d1b9243d75a053bbe2fc1234ee1d62215f3a124aa4350d2f4493edafa2328596e753fd23a0cecd466a7dc9d31f92309
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT7va:T6a+rdOOtEvwDpjNm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_49e84d6bbe341bc17a7fbabeabc36f34_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_49e84d6bbe341bc17a7fbabeabc36f34_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD52d36af8750674704e877c86bf6c68f9e
SHA195989350f60876bc0f8e8c88935e2ea7fe094e77
SHA25635cc9d45abbdf7ec8d30dee8ea14164968eeda71e7bf36ab990f34f8e4827331
SHA5122d2c3f87a0a1e1b5e82075f257066c8d42353398c94fb8916d639c62b4c3a5fbdbaaa66ba0f9cc7ff95c97f60398c42a75cdfd22ae5ed6b99e4594bf62b83056
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB