Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
09-05-2024 15:36
General
-
Target
2024-05-09_828003817164399147e2730670172af1_cryptolocker.exe
-
Size
58KB
-
MD5
828003817164399147e2730670172af1
-
SHA1
a5057dbcf76639e5567d2476a4b94c720418b786
-
SHA256
9c22375de9731dbe94d2abaff39e7fa93d627310656b1aba3477e0dde1edfbac
-
SHA512
88a78e89e155db4e4aeb35636a21904fc0be6b70b1e08419f5a07970079fe95242ff8d4209313607ca78467335a2014a683ecf606a3968a451cc8f4de2c76e53
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5ax+No:z6QFElP6n+gKmddpMOtEvwDpj9aYaf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_828003817164399147e2730670172af1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_828003817164399147e2730670172af1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD569245cd2a3889cb096b4750e03632a7c
SHA131c3c378560bd9338c2d36f2ff72c254eaa13f21
SHA256c80508ce3d857c6a5c96375c9b82aa4c58a859d4236614a2a018ccbcf58a1f61
SHA512315fa163f5850706e0bb01fcecebe58c6d94a3a35c4ff8767619d2cc57985e7344a610776821b420677917c381ca880570f75a2ed82822a806bcd20a7902143d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB