Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/04/2024, 04:25
General
-
Target
2024-04-26_0ce01ba894374b2d5d97364b8929072d_cryptolocker.exe
-
Size
89KB
-
MD5
0ce01ba894374b2d5d97364b8929072d
-
SHA1
ac450e603eef79c4437372909abf9b4f7d39ce46
-
SHA256
f250ab1904621a7e368450a917402bbb55eb85bc4e1dee34bec3007368143614
-
SHA512
d6c3cf22288ae159b98f5b5abe5387493a0c864aa5c9ac71c3b99f73054a64c710752a1ab789017d2e8447f3d8c8a4a85cddca7ae881553f1dd6fef58f23cafa
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddB:AnBdOOtEvwDpj6zV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_0ce01ba894374b2d5d97364b8929072d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_0ce01ba894374b2d5d97364b8929072d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5d6346d05c32508a53ea6586479d68653
SHA1cb0a86802e4a36a0a3032b079c14706c590125cd
SHA256c9fd62edbd5cf76abf6e030b80da5f4687fa86f862df720ce0251f168979d92d
SHA512863233e36eb8d366745a5c7f6f8421f5ae04fe92554659ad8075040c932b0b0f1847bb512cd92e6976b8ac37936ed164ba6169334c0796db18e19d1e16c455ac
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB