Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/03/2024, 22:29
General
-
Target
2024-03-25_3187a5b4ca4476f584ea1b855c32d429_cryptolocker.exe
-
Size
117KB
-
MD5
3187a5b4ca4476f584ea1b855c32d429
-
SHA1
df277aa5d41eee1da080e2d7cd44ce29db9bfd8e
-
SHA256
c2deac72cff1e6263973563a70af5037d54116ea17c6f6bc28bb924334a93a2c
-
SHA512
acc7767fcb2d8c032db69f9ff1818026783a784836441d171fde1e161e90cef343f9d08c31c0664fed1a155ffc6edf2d1b6533230d9c57bafbc22ece9a7e1d50
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01I:z6a+CdOOtEvwDpjcz2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_3187a5b4ca4476f584ea1b855c32d429_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_3187a5b4ca4476f584ea1b855c32d429_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD50b45753f629f82704c47677be31f7f73
SHA17eed22b29e245a7f8b9314f9b468f0ed0f2278a4
SHA25657baa6d6df26c96618780a3fcb718b88a8645ff9de73610a7da7da74ccb039f5
SHA5125082c725fca6cda9ba32ef1ce5b8759d0b1a0ee441962e83865c0690bb5f660a03021c2124faaae621f0c47b29f1893d96269fb7128d72034d376b3b946a9cc2
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB