Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/04/2024, 23:29
General
-
Target
2024-04-18_d305058a4682f15b820d60b79f5b6853_cryptolocker.exe
-
Size
38KB
-
MD5
d305058a4682f15b820d60b79f5b6853
-
SHA1
9fc64c09b6a31861e6261efdb933d4514a65a15a
-
SHA256
80f14121e621884efda56527e273820b459d565f174f2b5f83383201770ce58d
-
SHA512
647a7969c671b53976da1c9587898051cd29dcea49f577411821341989e98228b19cd13c5589c385a2de7e9687cfd67f5709776eb60a8b14ef82610be35f3119
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYD3:qDdFJy3QMOtEvwDpjjWMl7T03
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_d305058a4682f15b820d60b79f5b6853_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_d305058a4682f15b820d60b79f5b6853_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5b6963fc9621dffc7fdfb5f38bde7a642
SHA1fb8796de1fe55191069d31e8e9ac10aa5b6cbaee
SHA2569a60c94d0278d7ccf3a5f91d0ad167cf5888ee70140de05ff7a1bb93a1073602
SHA512284996a77dfcc87f3c111e05539d6f935a512618f6aac11dd4a0cd594e1d65180a7308cc22c5ab58d63ea21a957ef6da98a80b7e74146b0137e363813cb5baaa
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB