Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
20/04/2024, 08:31
General
-
Target
2024-04-20_65bba98264123e0229251c23812a9d5c_cryptolocker.exe
-
Size
38KB
-
MD5
65bba98264123e0229251c23812a9d5c
-
SHA1
d7182b0667bc42604f5567caa199de40e46290ee
-
SHA256
0ddf0a41e19d49f9ae1ca3b469f26131f4175055de841f2c5333d41398ce6a66
-
SHA512
5c4ea49ed1942e568b027b746e16d85f210d71641ee8b0bf5f36bec31f09700223999a8409fd24a67d06139e2381d6f8243aa1426e77a9be545907e3c51bc8d9
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITsq:qDdFJy3QMOtEvwDpjjWMl7Tsq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_65bba98264123e0229251c23812a9d5c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_65bba98264123e0229251c23812a9d5c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD54ea949a4f6ca6b2aa0aca297b1336c56
SHA1519c5780c380608234c016fec2e8e78e07a370d9
SHA25602c88dcbb7bafbf68787ed42902e5468fdaca6787797e635a923f2fd5663b4b3
SHA5124ff7ab3fa11d929859389692b461be837de20b39d9e8e53de9b619d6c19f8993f8e0440d29bbac7a54a9a8ffb5046a342b9b72a36f6f1bc67a82ca6c78f35d8a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB