Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10-05-2024 07:40
General
-
Target
2024-05-10_7e6d5f49f6bab493253ade002c80aad4_cryptolocker.exe
-
Size
52KB
-
MD5
7e6d5f49f6bab493253ade002c80aad4
-
SHA1
9d8509df6466924483bda01936510b9d269eab15
-
SHA256
fb0f285282cd08c2f6980612f283b1e99efe5701bffe239980b5b576f45f5668
-
SHA512
47dd73455ad64460e61d8be1fecdc271594b02c3538c40ec7ea31226d4c764d54747d683085c50ce1668aafdde3a6425c1cdbc154af1cbc85cb548b91a265294
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOp5:z6QFElP6n+gKmddpMOtEvwDpj31ip5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7e6d5f49f6bab493253ade002c80aad4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_7e6d5f49f6bab493253ade002c80aad4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD50d8a44ecf3a27ecf20fd613adf5059b1
SHA191f0c85aef3a494940fa2b1f0c0238a21229cec2
SHA25618261538ccdaf81bf16aaef257ed1ea675282567a7e12470ca7d3fd025fa9452
SHA512e972a30633d36c187ddf0dff54aff58bfe1052a4e80e8de754ea5e902d129f8a3e31a8fdb352dbd6b6e00b14583b06403dc3332e02c42efacd692d9a0fb64648
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB