Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18-03-2024 18:44
General
-
Target
2024-03-18_1bef09984765fd5fd2b220ff5b59b2d0_cryptolocker.exe
-
Size
35KB
-
MD5
1bef09984765fd5fd2b220ff5b59b2d0
-
SHA1
00371a76150b754e3ae04f450d031017f06f1576
-
SHA256
6726edb2dd254c9e1ad4e2520e1f88678d7dcd5069a8c1a05926ed287b7d71b1
-
SHA512
e96c50067627af0e6d8c43ad1ca7bcb38b1b8ae44359cef5b17af334f97d1011b3930be8fbf6e83bf726f3d4c16f6d8c91fb0a067aa5825a6a7d93147066777f
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/Dpkm:qDdFJy3QMOtEvwDpjjWMlp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_1bef09984765fd5fd2b220ff5b59b2d0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_1bef09984765fd5fd2b220ff5b59b2d0_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD51822c5a6376b6ee566aa34403d2c10c4
SHA102feaa833b14ceee4bf71cf089e4704b7686083d
SHA2566eff9bb2e57e8fb4174e32ecfb7eb561c286b8b2e35f73774599cf1343782157
SHA512a4f3b7cc42aba4dd5ede374c8640ab9831f7d6887fc4cb89355b0198fb3bc102d5e7d435264e4cbfcee487dd8d3742a8fc85ade95193a3372fff6fbe76c15802
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB