Analysis
-
max time kernel
160s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/04/2024, 13:30
General
-
Target
2024-04-06_3e5ce860ead9c2f3ae25f053ca240f74_cryptolocker.exe
-
Size
82KB
-
MD5
3e5ce860ead9c2f3ae25f053ca240f74
-
SHA1
7c238a6a51643f38ae0ea6b5de00dabb3a323892
-
SHA256
54be9e960ef204bd25edede94e7cba52433d3eaa7bd686d090269a8f441c322a
-
SHA512
62c27deff61026cacae7b931224cf8354458c412108841e6de95d5ec6af715612a0cc104b61a5eb66490f8f086f8bd5bfbe039165db7c11d203885ad650d1b3f
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBd0geL:T6a+rdOOtEvwDpjNtC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_3e5ce860ead9c2f3ae25f053ca240f74_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_3e5ce860ead9c2f3ae25f053ca240f74_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5cd97bd1423a770b2162826fab8baf3b2
SHA13490886fab151f39f54de7d33175a96c5a77b4c3
SHA2565e52d9739805b2c91495251686176f857dc4f9bfd7568133ab6fdf684ef156a2
SHA512b5665f3336f744b0fb751494bc397c35dfb9f04cb50e67aaab39cd1c57dbc84314f915dd7eb7b2f49ddf10820871b8976fe405e3508168098bd696b97e5fc500
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB