Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
01-05-2024 20:06
General
-
Target
2024-05-01_1170e3c347fec70e64a702cd0674706a_cryptolocker.exe
-
Size
38KB
-
MD5
1170e3c347fec70e64a702cd0674706a
-
SHA1
181d1001a5a11cfb3f2d427705cd1c01e94a25f2
-
SHA256
4e928a64a1109436f99277447561be4ebf689edcbf5e52ed60a397f871ca1a10
-
SHA512
9b188298aa0d3d5337dc55892be8a6f6780ed3f266c7d829cd6ce62b302146ed11d792e602df5c9ce36dda76cbc9c83562bbaa419f1525e51c9349928e8519b9
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYO:qDdFJy3QMOtEvwDpjjWMl7TP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_1170e3c347fec70e64a702cd0674706a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_1170e3c347fec70e64a702cd0674706a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD586b0d5600e56bd3fae09dc4ca92b4bd1
SHA1820eb9c420f5b4cf8c7ca89e841f78287c800b1e
SHA256cea967f1faf97084472109c14606d06846eabb233ec185c8081221efdf3f920f
SHA512e42d2802a74d95e7b86d6fa5e190ecc82d5b78a61fae01f6532beb1f2b3e0be82e967c93a175f1a000a25dcc0a7569a0159eac26b74f94d5a009d50c93230791
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB