Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/04/2024, 21:43
General
-
Target
2024-04-29_f1c324ed390afe5f89b895ed07d105e0_cryptolocker.exe
-
Size
108KB
-
MD5
f1c324ed390afe5f89b895ed07d105e0
-
SHA1
3a63e0618142a0ca4ba40406c61e465ffb2cc5e0
-
SHA256
baad6b51ce65171a1dbf972d5f0007cbe0db05823f486a6379558e9c9113489c
-
SHA512
3ec10b511a49e07e302879f07c6dbe51b8dda8d1ea929f7c4ea0fa8616d34be7c6845bed52bdd6cefa62938f8b08686f96da089ffba74ed69e23567b04950f73
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwMgv:z6a+CdOOtEvwDpjcz7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_f1c324ed390afe5f89b895ed07d105e0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_f1c324ed390afe5f89b895ed07d105e0_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD51132b7350702029d239c0c70e9583236
SHA16c118f93c1c8136b818403867f238527f635fb63
SHA256caef9a8b9193abd516aaf68921c3a3d2986890f9879cc9046878fb3326a5ff6e
SHA5123ad780a2c7a46da4ff273a0b628fa0583fd75a43e204f004f92b3c26fe49e9f8638428e8dfccab97a59d03fa41524ec3b4abb049213623f0b943780b73bb0b33
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB