Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22-04-2024 19:37
General
-
Target
2024-04-22_9f6bec46e7644a2560c7024a5c8c8f8d_cryptolocker.exe
-
Size
146KB
-
MD5
9f6bec46e7644a2560c7024a5c8c8f8d
-
SHA1
8bc8fed970b8a40e1d9de42ec582cbe2e4c916bc
-
SHA256
636e2a6da35fdd649c1881da33168fc5360c3b423fbf4b881461203ca5c3ebb7
-
SHA512
8634fdb304b1c222d744ce89262d6bfc7c5b8b3b968568676bed2d50aab9c336ed8876a7cd82156f7b854aecf294eb13478d78e6185e415210e4ebce803229af
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNgp699GNtL1ed:T6a+rdOOtEvwDpjLzX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_9f6bec46e7644a2560c7024a5c8c8f8d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_9f6bec46e7644a2560c7024a5c8c8f8d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD55d12436bd9b280719007989a12848c3b
SHA197c4eadfffd22fdf1c6506f85e1c8bae584d1cb2
SHA2563230b5d01c82e24d06b29450e1ca1ebc91753acf9f5bf4abe2c0a07cd93c5396
SHA5125efa2b479fb4c96c59799946160bc493d2486d87024b14068feac6804bf4702208362978e36bd3044c00044c309efa3ed8b7a0923f432b930cfb277e2bd3a1c9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB