Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
09/04/2024, 10:26
General
-
Target
2024-04-09_0c21e5b15cff36f40f145e1fa2883d3a_cryptolocker.exe
-
Size
36KB
-
MD5
0c21e5b15cff36f40f145e1fa2883d3a
-
SHA1
128b6cf0e3750f8831c0e8e3d92b51bd825e2ee0
-
SHA256
4fdfbe18f4d55afe7f0661d7d2e50fbe4afd67e14e6c06f3c06ba76c3192ca0c
-
SHA512
5a1b03f6d4f458d52bd6597ec13536d4e5454d110aa09422c252d72095cc12c0dd072ea71cf3a71f794ce4544a89677141290922a4686a012fa7d0b645ed91a8
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYs:qDdFJy3QMOtEvwDpjjWMl7Th
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_0c21e5b15cff36f40f145e1fa2883d3a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_0c21e5b15cff36f40f145e1fa2883d3a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b7a2da69c6754d5f285fab07aff306f4
SHA17d6cf74fb8881b6b2999eaa4f8d0e209a6362d95
SHA2564f8da9e0701570d13f3b49b0bbce31c4348064b22476743e8aeba4c1fa9373f3
SHA5123603e64fbd3c611499fdd3d4905b4f90b15bdbaec2abc3d775808e77d9dc1ec92daf179286956afc49025ea8531ca2b0cd562a4bcfb1afd3015f9e9aee580408
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB