Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/03/2024, 16:37
General
-
Target
2024-03-29_32b4d03ba63793aa81aee4fadd2a258c_cryptolocker.exe
-
Size
109KB
-
MD5
32b4d03ba63793aa81aee4fadd2a258c
-
SHA1
0cd2d1f6e358c53a3f5c56dfae2319327f3649a7
-
SHA256
cc8730944571f9cbac8df57150c8905d896c61c4af4f64eb534e4fa1f8d7918e
-
SHA512
70d20ad2e13b74079242ba61dbbde4c30c6efba89cb4fd8a45cccfb608357f22bbed9a1e321419514c8bd6dceb24524f5d70ed6ca682db8cad97a2efb979bd42
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gkszfh:1nK6a+qdOOtEvwDpjl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_32b4d03ba63793aa81aee4fadd2a258c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_32b4d03ba63793aa81aee4fadd2a258c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5445e0f6697383e0ea218ce11132c489f
SHA18c45c854f7a0596d7855a6b4eb1d24fe186c1343
SHA25648ee01fafd5894ee469685f4d5f9dd1bdb25f37ab7814ae3fb7e408805a55a36
SHA5122b7d55b0276e45f14f167142c6ab6b7835d94f3661dd26bc5a71c1a394f51e8c2a806b2fe1e0a56d2fbc5234186228df539f76fdd6e49fb39407356f510e18c7
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB