Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/04/2024, 21:58
General
-
Target
2024-04-30_f7917ebf0289c2758a6aebd12b79ddc2_cryptolocker.exe
-
Size
38KB
-
MD5
f7917ebf0289c2758a6aebd12b79ddc2
-
SHA1
f620b46fcf538c1af8f3bdc744fbf984f9fd10c6
-
SHA256
2216b9d05400e43df7dd37c72a8cdc57b61b4cc871e6cee6e14d10394b47b0d2
-
SHA512
127696c2c6298043504eb6ecbe87c42d03b4814059a88b656c3208616c34b8cf053d5ac3fa3027eaec44ef6810d888e297d36251bb5aa69a769ac59fba83723e
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9f:qDdFJy3QMOtEvwDpjjWMl7TA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_f7917ebf0289c2758a6aebd12b79ddc2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_f7917ebf0289c2758a6aebd12b79ddc2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD586bde499280a420770cc706e09c39917
SHA169995e37253cad9b4675b8a9701f99378694e777
SHA256d31d52587f8e4ed1d1892ac11f56b0ed2350512cd6aa95bb59711216b6492074
SHA5124c2fc3ec5f590efab40a3f824325d5ccb78c63aba299eb0bf53730abdf1d2c1a548754cfbb6db9a6ae3311d355f4d30ca32400f29e77df8b947b26f1a4d49147
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB