Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/05/2024, 03:24
General
-
Target
2024-05-09_009650dffc3753cdffb61c85d772d801_cryptolocker.exe
-
Size
37KB
-
MD5
009650dffc3753cdffb61c85d772d801
-
SHA1
cfd516bfaa2736231a0c8338b5e6634613ab27fc
-
SHA256
25064251600c3a6dbd2b964285b22acf72bdc38e3017f6c1739d495f44a9fabc
-
SHA512
d7f66a4fd35e21b401d167baa2bb1e85c6afb58880e0e6c8211583216e421d8a12b0382dab429272307d42f388cd4cf1f4924fb3301176a7ed3e942e3e79d171
-
SSDEEP
768:qTVbxjgQNQXtckstOOtEvwDpjAaD3TUogs/VXpAPWi:qTJu9cvMOtEvwDpjppVXzi
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_009650dffc3753cdffb61c85d772d801_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_009650dffc3753cdffb61c85d772d801_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5102613c73af9092a230bdc6b5b786291
SHA1d99f4ed74ec69540dd69192849e04133b7da81e8
SHA2564497f8bc27272835bcbe580d36ff6b89cd5e6b6060f831a5bbe5b8e172bf8ec3
SHA512505eff52f304e7708d32ffef6177554cc5f40f573893dfdade494120b79923b4f4ecb47b58f8e6dfe1a4a8afcea64532c3e0b17f1372f9f250f3b35818c223e6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB