Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/05/2024, 04:33
General
-
Target
2024-05-09_50af9f6c510f6f7832a9309ca6b1dbdf_cryptolocker.exe
-
Size
58KB
-
MD5
50af9f6c510f6f7832a9309ca6b1dbdf
-
SHA1
1d86556814e17e7481d3fc7a16a728af442ad248
-
SHA256
384841446655162294b2af42115d0f25e80a928e36cf8b8b9d349fa565b2169c
-
SHA512
03ff64922002e11c18ff41ae40dae662e4a0ae2d47f9df9b5510be50ea533e89111b8bdb6dfc2f30d81469c177c7ec012cd0fb5f193e237252a98b7a8d087e39
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP6pV:H6QFElP6n+gou9cvMOtEvwDpjCpVXL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_50af9f6c510f6f7832a9309ca6b1dbdf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_50af9f6c510f6f7832a9309ca6b1dbdf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5ee7d5dae40ac63eefd253accb24c237b
SHA1be614fe06642cb4f0f54d3dcf0c0bfac070023fd
SHA256372aa6f06f72a6aafec5007c198a015b6d99b88f0dae0c4849c64a1b171f40ea
SHA5120c21c57536528d946177c4fb0195337b0b9333f41ac2bf427cbe863f3f0b795ef7cbf348e405dda1414445ced3371685a9d233ebca1b9b381582573e11398bbb
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB