Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
20/04/2024, 22:21
General
-
Target
2024-04-20_0a9477f00465b8571a8b80d8c910bd13_cryptolocker.exe
-
Size
40KB
-
MD5
0a9477f00465b8571a8b80d8c910bd13
-
SHA1
5d2757463016a70a7a9854f33551442df7c57698
-
SHA256
92b6541a5ce82490c33ddf853b3d370ce5b070a244b71177bf735d820aea3bad
-
SHA512
468b8e2fd4652746774f3edbd7f1240d1b2c2936b8b9a7f1ad1730526e5f706497ef27d6515279093feb0ea35f1e4794f8e8bc3fdd3c7fdb5530a6114eae7011
-
SSDEEP
384:ba74uGLLQRcsdeQ72ngEr4K7YmE8j6CQYnrz1ZhdaXFXSCVQTLfjDpXqxKHQ:ba74zYcgT/EkdCQgpwXFXSqQXfj0xKw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_0a9477f00465b8571a8b80d8c910bd13_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_0a9477f00465b8571a8b80d8c910bd13_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD52bd4a17d09ded594d399a513cd65b89c
SHA167c03492659f46e3cf011ce91e79dd09a9d8ca1f
SHA256167402bc18523c07adafc3e2e4f9e2affd9254bc5647656cd87025f8cf8fcc05
SHA512b17c096aa32f6442e3db7046f22f2b9683ecefa19bdd67e450caaaef89c117dbe475f814044e8c359615d58e3284563c8fd855b56e70a687f7b5c69430206027
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB