Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23/04/2024, 03:27
General
-
Target
2024-04-23_23336067630dfe6a4f7f48ce3e515d60_cryptolocker.exe
-
Size
65KB
-
MD5
23336067630dfe6a4f7f48ce3e515d60
-
SHA1
c0fb2d146a6c55c93b1a7d3d3a021217447c0aa6
-
SHA256
8ca25332aa65fb7219b8852e146757ca097203661783b555e2e925936dd3f489
-
SHA512
ebf610dcbb6cecb51fda0e73f92b84d5361947a15eb5f574f8171dd7fa2ce7a6538dc711ecdfd6837e2f7dec11745324bfbacd35099bc238eff0b098c38444b9
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xDyC:1nK6a+qdOOtEvwDpjF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_23336067630dfe6a4f7f48ce3e515d60_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_23336067630dfe6a4f7f48ce3e515d60_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5f1d170192f83a9eb69882998cfaa0d36
SHA1a802d6d583509b89dc1e60a9a9f4c7372a176f90
SHA256e424a6f9d1a1808665b49a91b5b55840ed7ed30884d14b82bde22160c5aa745b
SHA512964aef48fb93363e0aa4155a37fa5b480bd2f960329d1e12b0d2f9f75255707315a7d6e0ba704b553b7e9f53f91926b1a267e28070c37e8981f8a8cee6182322
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB