Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18-04-2024 20:35
General
-
Target
2024-04-18_ea5171abeeb10045ec04fd1a7cdeeb61_cryptolocker.exe
-
Size
38KB
-
MD5
ea5171abeeb10045ec04fd1a7cdeeb61
-
SHA1
efb9a8e5e049c8a386915bf46c8b5f0295f2c526
-
SHA256
6b1e45b6cde26368eb4d635cb8844754e08e10ee9b7cbc388bf24e44df2b4a1e
-
SHA512
aea6ce557b0eaf2ec3e67eadf1a918331d6024bb115fcdc96b5c2a3c2fffb5336f25c8f22169fc65f782297f5395b18c92b10270c7d07a0a7718e29d21618f9a
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYDo:qDdFJy3QMOtEvwDpjjWMl7T0o
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_ea5171abeeb10045ec04fd1a7cdeeb61_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_ea5171abeeb10045ec04fd1a7cdeeb61_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD559c9228fe8228871815ffc5ed3e2775a
SHA115d3c44a7b57a8866bdf213b7019cf5cb594ed28
SHA2561331055f4f5550a5538006f2edc1d8e9cd5f056eac3b89164e348a6d40939b3a
SHA5126805eff35c7a59489c7c45f904f4e4c9bbc097848dcf4cf268fdda9e29ecc90ba4a62dc494fd2a7f861bcd3227c43fd17678493b563784014f3b3320cd37afb3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB