Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
17/04/2024, 08:47
General
-
Target
2024-04-17_ddf831abb9713681e0a12a52a7c1af91_cryptolocker.exe
-
Size
68KB
-
MD5
ddf831abb9713681e0a12a52a7c1af91
-
SHA1
b1d8b7bd592409ebf8cf6f6ff873d3c71f303736
-
SHA256
996130b46224bc91f71aaf9c787db3e482b4e6c0abaf32242ca2a2e0cc666914
-
SHA512
252667f5be26eacbfd2980aa8b1035733dd7d4a8aea437e78b2951a02b4efa47f6db21ebcf6da1ece6870b097be973fdfa4270cd4e485e93c954fdbbd7510a19
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1PM:quJu9cvMOtEvwDpjWYTjipvF2bx1PQAM
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_ddf831abb9713681e0a12a52a7c1af91_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_ddf831abb9713681e0a12a52a7c1af91_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD513d051de52a9cdff33a5c7e6620f2a02
SHA1fdfe1475e12fb915435a54eff6cd5e676e6100a2
SHA2561ecfb2f4e3a38a6b9b83cfd055a3518f7ab421ff67a6020854a58481316eef34
SHA512d5b089dd28ec26d12ae0ce295e97c064f03699272fdf3b438a1a71d3a4a98ebdbc3fc85d1a4916c165a423bd532c357c507b40be5f01feb5636c0fef39cf8041
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB