Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/04/2024, 04:00
General
-
Target
2024-04-19_6bf8bab80a24f55fa726a26380eafdc5_cryptolocker.exe
-
Size
129KB
-
MD5
6bf8bab80a24f55fa726a26380eafdc5
-
SHA1
a5e847867ae2c08a10ac2dd42a9429d8a7945350
-
SHA256
3b845aad0afe3d177701a375f8968ecd30f920d11a16c1884c40fb10304c70fa
-
SHA512
4f0bcc62669a555629d7910752b4f2993939793db112ca063e7220c3068da4860f28c8ebf6ea39530f9852a7f42006820451b556fb1c8be1734f08136bf56f67
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eI7N:AnBdOOtEvwDpj6zU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_6bf8bab80a24f55fa726a26380eafdc5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_6bf8bab80a24f55fa726a26380eafdc5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD56b90662f81bc1556cecb198b556b1a6b
SHA10f4792a62f62fc5b9f3339e9213f513376e5e95a
SHA256bfee5e0e1eb28600e887c71657fcb1a82b27ec37ab1887cb1d076e7fe2a3d3fc
SHA51265592a8c59cb36c7fcd28e4140301bf683e286c2ea52204f804c1513c9864e84c28f2d1b04325e6ec72410130ca7221efaa0961678a54f97d7a5ba8cb4e1ec64
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB