Analysis
-
max time kernel
153s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/03/2024, 12:53
General
-
Target
2024-03-25_a402343eb091a011daf2816599aeb8fe_cryptolocker.exe
-
Size
102KB
-
MD5
a402343eb091a011daf2816599aeb8fe
-
SHA1
7697fbb57974542813bc981910ea892ca3568fe5
-
SHA256
a0d99144ebd4301406c72155f65fd280d583e5f7a00dd83029d00b09042c5773
-
SHA512
e778f0c914e1948dc2e3b25e09e646b2cef345a955a6169ec8d035ca9af6036b4363999b70cc03b5bf42d9fc6329e9ae4962656eaa9de941c850894b1917b1c8
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviy6ixp:AnBdOOtEvwDpj6zG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_a402343eb091a011daf2816599aeb8fe_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_a402343eb091a011daf2816599aeb8fe_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD5c5a0f0a717c328c27d8385f87819016a
SHA1ce1d8ecbb29abf0ac060ca015b43e9711792da98
SHA2560846cc90b923b0fdef94c71e823e534676aea88587eaf505e3294a19ec1d4894
SHA51208be2cd7fc45da3201cb5baa7c960cae21c9c40b9819e641094348d3bb04e49dc592a8e5bbb437f239dfec213ed3e57336691f452743ab315f2f53be30d9c7bc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB