Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-04-2024 20:35
General
-
Target
2024-04-15_3fdad827f501f9a884e3cf3356de77f2_cryptolocker.exe
-
Size
58KB
-
MD5
3fdad827f501f9a884e3cf3356de77f2
-
SHA1
6d7a7a3ff0b7c569f0cfd78723f5f80e92fe4c50
-
SHA256
e6da00b30b32ac66af2ef642ddf6044bcde0a6e9dc391c890f1dc2fbc3a10cc2
-
SHA512
10c8238f24a62a7ed4f387ad87201a73906a36c01050639815ef284513e64dd4b33d95b7a64b9916fea450f3eab212252516fbd7213e48caefdc12e200f80df6
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYa59IEZ:z6a+CdOOtEvwDpjQh
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_3fdad827f501f9a884e3cf3356de77f2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_3fdad827f501f9a884e3cf3356de77f2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5f6feeb382d474578c0a6ef1d0007c4d0
SHA10ff3f24f213b51584e4c626812c60880c4a390ed
SHA25656e3811bb68c36a2d023a33a3bdf66a34a7e1dbc46f4087d155a1a7adefcb409
SHA51202a73684eea626fd768a305894f1d8511293f750f8733c49524d35f0e85e44b6c5c2babf394598daffd19bcff36aa1cdfa146fab9fe7549a53cf0c1e69612ddb
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB