Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-03-2024 21:32
General
-
Target
2024-03-19_7c39adcbb8e435f8d8a02533281a217b_cryptolocker.exe
-
Size
58KB
-
MD5
7c39adcbb8e435f8d8a02533281a217b
-
SHA1
85713c8942b4b1731093efdc86ee9a26129fd2b9
-
SHA256
780a417612cfa560e905378de89bfc152f680f76468772f855e731c2776407b8
-
SHA512
1725d5c0a1ade318d464be9cc20f3597e4b5581ec67ca369f16e935e965a7a5f179c73a92989903a5b79dc1faee2667570b5e40f9ce25565537fae612dd7bf8b
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5appRR2L:z6QFElP6n+gKmddpMOtEvwDpj9aYa32L
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_7c39adcbb8e435f8d8a02533281a217b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_7c39adcbb8e435f8d8a02533281a217b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD54f3952d5c7b785d7c9d7fd0a50b7ade9
SHA171fb0868ca45f9e2e848312d7a2fedf02de27cf4
SHA25637fc90971c11fb452f71e98a2759869babfc3430bcc04ff897dbdbda57752ac4
SHA512bc704023dda1a6b5a53cf97049cd2bd06874340776fc0a7992372d79ec7f3401a5ceaa2e85a8630eaf7c2e9a6b8ae8433c271418a15520e1c0a9c89703af30c5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB