Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-04-2024 20:13
General
-
Target
2024-04-22_8474610682e93e81bc16267d36ba9d07_cryptolocker.exe
-
Size
38KB
-
MD5
8474610682e93e81bc16267d36ba9d07
-
SHA1
c52e9ffbef26f1d53e587b61940fe821b8a67f72
-
SHA256
696fa0e56104f9de786acc12f328ca70bb5aa2acbbbd8366616b664105198403
-
SHA512
e9a98254adecce589d82c37ba9e990f4b39849534834c2c861e7fca7f62ce287016e12cd4684a702437864a8ced198bc5ad9be3a2b24dd33eebddc84abee7bd1
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYe:qDdFJy3QMOtEvwDpjjWMl7Tf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_8474610682e93e81bc16267d36ba9d07_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_8474610682e93e81bc16267d36ba9d07_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD52563e0260f34959a3ba22dd5b59da12b
SHA1c22742d1646c746526dbf888350852c90129bd6c
SHA256c289268301c68e3a80cf6c5bb6abfe6970893fb1ce1878b61676a30b5acd9d31
SHA512e5b8ad39938328dc8a1e21771f7af8645c3252b75f2fa357211a598365018433c1b87eda344355f1e026e58406ba79d3742341e9e4e4b0d7de64666885a3759b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB