Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/03/2024, 15:29
General
-
Target
2024-03-18_224083c8faf69728c1b696034c0a737a_cryptolocker.exe
-
Size
34KB
-
MD5
224083c8faf69728c1b696034c0a737a
-
SHA1
4a6d82e8790ec2562193a5642755c72c43dafc04
-
SHA256
5457ac5d458cfa88ef11b59fc8ddf42bc9d9cb8e4922f1049af9f4dfd9d4e512
-
SHA512
1a6734d1c633ac3e7f5964f5e55b52dd38ee8abb77530a64c6bad35e147e13db44bf6f9eb4f3c2cbd2b14f90655d8a1d05003c70c8b5b0fbe1f4089ae3e1fcc6
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axRL:qUmnpomddpMOtEvwDpjjaYaXL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_224083c8faf69728c1b696034c0a737a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_224083c8faf69728c1b696034c0a737a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5f803aa12a174b8ae6d21970e4aa3a06b
SHA1fb0f69bf77325163d09e5537419f16b01b3494e7
SHA25655a5afc76c2b5199ddfaef036046d11ede9d7214fffa771eb658abc54867798e
SHA512859055f5971f8f4828cc2fb3d8e82ec836cbb4b2d85a613e1b7ee3ff3790a08418b88e36e4af19f8a3d74522fc00b73409fc9f05342ce03d691875cf9fcedb7a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB