Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-04-2024 12:32
General
-
Target
2024-04-08_539de677a3307a34083199a9adc922e5_cryptolocker.exe
-
Size
128KB
-
MD5
539de677a3307a34083199a9adc922e5
-
SHA1
17828c1e0605e276aa0359c998de6b2ee906642b
-
SHA256
95e932d38518aa89101c8dd6187078667d04f4c4383d3eafbd92f6159b6b8ff9
-
SHA512
f76fdaca10a6fce8bbbf9af87264fa9d2761dbf0b22546c19c5a93a8892a47f8e9ba0affe719694f63269c3855486536a57846f9343a4381da0517d9f1451038
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eI7k:AnBdOOtEvwDpj6zN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_539de677a3307a34083199a9adc922e5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_539de677a3307a34083199a9adc922e5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5b2ca5a972104ebfbd9464148f97ddeae
SHA179b0ee8cb14e33742a74a2c6a82573e8a0c732b0
SHA2565a48f52d3c5d4a57719d7112691695d2edd698a2ac331dc04b0848adbb21429f
SHA512913c2abd7b935a1ce24c3dfbb9fd847995d50b0c9ad173ef0388de72c5e67456f62a16ce22c8f2cf4b82f020e3dc5db7623149c0e086d0607d01ddc1b5dcc719
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB