Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19/04/2024, 22:24
General
-
Target
2024-04-19_53918689c96cb43e9bd53f8d2c6a296e_cryptolocker.exe
-
Size
38KB
-
MD5
53918689c96cb43e9bd53f8d2c6a296e
-
SHA1
7cf6d5beba133ffa871636cc61b1432143276bc9
-
SHA256
e31dcaf1b8340f5c7e1cfd52c3b9279f1d275ad7dae56c0effe46f910364b7ba
-
SHA512
474c8e4052681608bd3c140277818dc924f91198066319a77b82800b806d1638a972409d415797bade0c98a1340e2e4a3ba435808be555fb3740c103496230df
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYa/:qDdFJy3QMOtEvwDpjjWMl7Td/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_53918689c96cb43e9bd53f8d2c6a296e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_53918689c96cb43e9bd53f8d2c6a296e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5db8ded9190d264be9757dbcca8705412
SHA14f5071a4f101faf007c4a81abd92381dad08a9d3
SHA25619851f0e930b65970319d3cdd1812d1e8341a1ae497f339b26234ff34fec37b2
SHA512f52ad891f966b4ec490287fcfac75f835d873b3287d53d572823ab2bb70e3bc5e102463cf2bb150ac439b9b7c5dd80284bcf5332fadf41c06381667788bbbf99
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB