Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24/04/2024, 04:28
General
-
Target
2024-04-24_34340e641b7b47250738ce53c2e41b1b_cryptolocker.exe
-
Size
40KB
-
MD5
34340e641b7b47250738ce53c2e41b1b
-
SHA1
2932357f4b373b20623d24320fa155737d4e4afe
-
SHA256
7e3b4b8c505f7a008c6e5aba52feea586955c7e5427ac016f4658ada082fca97
-
SHA512
e9be08963998c1e6f0a1e33eb22fbe50ce4f11b5c1a0b468fc064a7ab25765758e5f73924a5649c42ad339da74baf61cb12cd30dc3a32973839021b700054f20
-
SSDEEP
384:ba74uGLLQRcsdeQ72ngEr4K7YmE8j6CQYnrz1ZhdaXFXSCVQTLfjDpXqxKHj:ba74zYcgT/EkdCQgpwXFXSqQXfj0xKD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_34340e641b7b47250738ce53c2e41b1b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_34340e641b7b47250738ce53c2e41b1b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD554f1dde80f7b527b29808a79e6374417
SHA110266c95482d3a343b5be825844d1e50ef2bcc69
SHA256c32a1541bd20061320da715ad14144b4ccb4abe1254e377367f13b4ed2d74c95
SHA5128826ee8391fd26502162d924fb52cc9c9d9ffaee88d10112153fe8a3261d525efe003287725924d997cdadaefcc50858d620394a0cedf497a38e157b5f19d647
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB