Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/04/2024, 20:41
General
-
Target
2024-04-08_cad09481c041a91c73a94b4aa584b2b7_cryptolocker.exe
-
Size
36KB
-
MD5
cad09481c041a91c73a94b4aa584b2b7
-
SHA1
f4dfbcd1a334467e1fba2d8b11cc69c89908f377
-
SHA256
a484893f8e4bc17dfa5046b723ebbdb873589b24ef020dfcd2f04c8c50b50ac3
-
SHA512
ffebd1b4ff1925eee15460a9ac25eac944b90a72fb0076770a4b44f3cda5fb0b6fe9abbe2bf0f33528454bf6132bca9e4a6d800ec7b5acbf6046f16332477854
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/Dpko:qDdFJy3QMOtEvwDpjjWMlL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_cad09481c041a91c73a94b4aa584b2b7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_cad09481c041a91c73a94b4aa584b2b7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5f00d789e0ac3ff292085ce2c8d371981
SHA1f4d4b816e7ab31bc41b3aa94608351a223edf8bb
SHA256b52b6cb14556a217054eeb66f8e8a53ef562e85f17fc707028b43c70e7b9fb34
SHA512f79b7d21bae09da6b51e152525f6d992bf98216dee5557ff92c61c165c499c41e7529db327e6da4523064b2ac4aef598e1e8253b58edd4c124613875de87ad83
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB