Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/04/2024, 06:47
General
-
Target
2024-04-05_fc09c9c909f1dadf5a80c95fccf4cbf3_cryptolocker.exe
-
Size
50KB
-
MD5
fc09c9c909f1dadf5a80c95fccf4cbf3
-
SHA1
d5e5ec28317d7aebc30733a8848f5b60989d3a17
-
SHA256
db1ab94273d0b8de391f401174c3846f4994bdac79ceb40ff0f625efb697d7c6
-
SHA512
8dd4a4fc612d2aaa4074ab687e5da4871ab473886c62973e5b62d8ed0ffcf12ee1c80602d84bc075284556389b118618e121ab987eb8428194a3798bd4e9d035
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OT9y:z6QFElP6n+gKmddpMOtEvwDpj31w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_fc09c9c909f1dadf5a80c95fccf4cbf3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_fc09c9c909f1dadf5a80c95fccf4cbf3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5b25ae238d4c54bca28c52e628c5beec4
SHA15affd8926c54b478182a61aa716654dcb43b8cbc
SHA256a740fb61f74ac5e6ce0da4f73e4d0d9a73c0447564e0beacff92efcd09381c19
SHA5123803f20efad7a6d3d19af91018406d6f34a6b1758b86dadfc9d44d5426cae83783d81c6b42b30a1a677a430815344cff43f67cf8f97b75f81eb0ed4b7b03d4af
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB