Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-05-2024 08:37
General
-
Target
2024-05-05_e8574fda6b4ddf235348bc12598d9c0a_cryptolocker.exe
-
Size
62KB
-
MD5
e8574fda6b4ddf235348bc12598d9c0a
-
SHA1
0ae32d2d34c9a63042a93dcd52b2e0edf21ae64e
-
SHA256
4e184d635dd2679d0258169ac290031ee1d441c7cd0c92d2e8160e6d101e0e81
-
SHA512
ac57669ec3485909c71d5cfa2bbfa282fb371600834816c88c5d9c389cf32fce2b4deca51dddcfb815be03c44e87bde5db9f3955a74f33eabd499a199dbd4db4
-
SSDEEP
768:P8mnjO6LsoEEeegiZPvEhHSG+gbum/kLyMro2GtOOtEvwDpjKvWxHCbSVaFn0jKF:P8mnK6QFElP6n+gymddpMOtEvwDpjYM+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_e8574fda6b4ddf235348bc12598d9c0a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_e8574fda6b4ddf235348bc12598d9c0a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD59a1c8b39188557a91a3c93a7c0427eb7
SHA19768f2fad27ecb12f9f86e25371f510e1e9edd0c
SHA25666c313cc1befb6c1394638d5db45b08564939dce9fcbdbfe91ccb2abbb0be041
SHA5129d45fa77f97ab54cc2d829ebc4207a4f8b7dce5d9b05928468247eb8667ea67e09b21cb4cd1e5ed0c6039fdf63971e74c273eeb73faaf2565f57bca027c8bcd9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB