Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02-05-2024 05:59
General
-
Target
2024-05-02_ca57c4a86ff4be1368803996983d3024_cryptolocker.exe
-
Size
90KB
-
MD5
ca57c4a86ff4be1368803996983d3024
-
SHA1
99114ddcd085dd0d9c260fffa51ec2426e8b4880
-
SHA256
d8f7ba36b1d845382eeb1b7fe8368c04ba8777d35382d8c97480336990e0047c
-
SHA512
89331fc020da72a274a799e3d34e6aa961278672ec8f7b81d48b3c84ebcd8214bd67c05b617b4a940e51641145bfaddde2820236d133120ab9952e8fe7b2b64b
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgdd2:AnBdOOtEvwDpj6zK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_ca57c4a86ff4be1368803996983d3024_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_ca57c4a86ff4be1368803996983d3024_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD50f3faecffeefea549a1983669c371f11
SHA1b7e4c5b46da83eb009ee380d87c4778039df9b6b
SHA256e88f5e5528e21da66af201aba70485f7612d748c8490a29d70bb30b60dbc3b81
SHA5121bf0e9f50850e7364f42e232084b51d1093d22bb5c00115a8a447beeb3c99d0b4e54502a79563bae090ec326385fd4dab54434d6c12821ed3605b47a9bcfd4df
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB