Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
02/05/2024, 01:08
General
-
Target
2024-05-02_d2bb6b941c4b568e563f12f9e735bc7a_cryptolocker.exe
-
Size
37KB
-
MD5
d2bb6b941c4b568e563f12f9e735bc7a
-
SHA1
0236665af92521de1fc8de38faf717553b237158
-
SHA256
1bd5cfa39b3ce0fb28add507a9772f6effc9ba961afc3359a55f17331357eeff
-
SHA512
9add1e0531abed771d855a268ec6135fdf2d70ea9e53284b62ef8c9120053a60b0b5be581a30eaf06a5c2dadf1f3509a5b9586b437bcbab6d3873e2d49dd9e57
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYF:qDdFJy3QMOtEvwDpjjWMl7Tw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_d2bb6b941c4b568e563f12f9e735bc7a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d2bb6b941c4b568e563f12f9e735bc7a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD55c7b023a8465ac9297a3712ee66a4ce4
SHA1782b9bcc4485314a50eed4bcfb57e6237032345b
SHA2567deb3b21274240ab0174c5ea38e1d0f27f05511af4e49f86f6c275453cf61660
SHA512b994dae9e8681af5684cad7dcdebbc76381dbec94f5a89a91e03e54a35d41ebf69a31df99111850588ec19ce53ab31cc2040cbddc6b8e6868e49769b13fc1826
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB