Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04-05-2024 20:15
General
-
Target
2024-05-04_be31d9b74f3a8069072de65c25af5a09_cryptolocker.exe
-
Size
38KB
-
MD5
be31d9b74f3a8069072de65c25af5a09
-
SHA1
9e153b30cdf6499950ac2d071d4f049c49787a2d
-
SHA256
d1743549423b83eea8561b39e178d4dde85f37340d57d164e8adabe391933d71
-
SHA512
77f8de7763ea926fd38e49bc209066af2e2d5d707a387f9dbc43621f19a7789df08e7a0011ed3b50592643acd2559654857765f8a61200fe94636fc56303e7c8
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY8:qDdFJy3QMOtEvwDpjjWMl7Tx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_be31d9b74f3a8069072de65c25af5a09_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_be31d9b74f3a8069072de65c25af5a09_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5c31467e9b71025306efcda7ac077b154
SHA16fceba3f46823f01f5e461fbfe922114e5e3815f
SHA256b0525cce069e6f22ce1dae95eafd9310e827f8eba9637d01c1a81af2e3a6c02a
SHA51211d4604357ca72ed064ec4f63f4515eae211c6dea6712a9cca792456717a7a1f2fb88530b35b4f0389529d85d9a94c4b20eb1c5e626ce163c5b920fe71e81029
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB