Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21/04/2024, 01:39
General
-
Target
2024-04-21_f731374da49f0524722e8546f3c33caf_cryptolocker.exe
-
Size
129KB
-
MD5
f731374da49f0524722e8546f3c33caf
-
SHA1
dac0672a54cbe00055d92ceca68254eeb109c6c4
-
SHA256
de348ebc9ac8766c9881d150cc6082c40bb7c563a2ad6a505345d27c50c1a9a4
-
SHA512
43207e6e1c4844e50a3cd4e9c16d5e63a8f3116cd4820f183f6ddfafd77ebf1de3c37aab6c607e9ba3b3cc9f903055f7f4f1163525c0bf37bc8b749cce3e7f24
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eI7M:AnBdOOtEvwDpj6z1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_f731374da49f0524722e8546f3c33caf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_f731374da49f0524722e8546f3c33caf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD55393b180d87fcebf9bb2508dcd67dd1e
SHA11a88d233d6f89ab92b545c353b036141d1dc9f0e
SHA2562bac3f7bc2b7b6430a626335912acd90e31c81e9b46c0ba78942fe9fc0888aa4
SHA512387fb7de95e9be0439d0572a9ba635856fa77f76e86a68544874ed3a4a525aaa0d70ec8a8cb0470d0767a4efe0d75a5ca781b5980bb0ef5febb77c9b977a372b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB