Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
27-04-2024 05:18
General
-
Target
2024-04-27_e69528f772b5dad2626523257bfbd8fb_cryptolocker.exe
-
Size
58KB
-
MD5
e69528f772b5dad2626523257bfbd8fb
-
SHA1
32a5e7b77feaa6904b6b8ddaf39250d706af81a7
-
SHA256
c78dc86e837bd2fa7dd104e18890ce86c8c2e20d3421b2e4e3bc516be4e18075
-
SHA512
812a7cfea7f295a99bb5bf0b56d4ab69b3da60767a70326778441ee781a0cbf8ccfa98ed1b05f74f8b4b8e4a988e556b2fc57841532df019194bd56525486bba
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPb:H6QFElP6n+gou9cvMOtEvwDpjCpVXO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_e69528f772b5dad2626523257bfbd8fb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_e69528f772b5dad2626523257bfbd8fb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD546ad6d8e32d3ffc74f2d698a20b89b3a
SHA1b17f5893503dfe3613491a5941fd5cb5cfc5dffd
SHA2569025a657cf62e010da2784cb29728d98d403e1d59f27a9360315536dc8b198be
SHA5129fd0db3cf67d960ea2bef25dabfbf9d7c0cd71c7195d87b32f769f36c4e2b97dfe9c5770f4576708a17831342fe5927c71788115849a6d92e42e65f8002e0eaf
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB