Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-05-2024 19:50
General
-
Target
2024-05-10_77adecd9ce07503af0a625333c152251_cryptolocker.exe
-
Size
39KB
-
MD5
77adecd9ce07503af0a625333c152251
-
SHA1
7aa5e0026cbf7a38d94957b6ac7e1db7e682d69c
-
SHA256
13da9fe90c93532bc45fc74748a8e7a45cb46afc8245e38fddc850858096cef5
-
SHA512
546c83519908a7225c67ec5eca1ec382719e3a377da96f0298b113059447597ad90f82cb6e7e29c906958cabc5482b02c69dab0e5d3d6779525db2ab06bf0731
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYD:qDdFJy3QMOtEvwDpjjWMl7TS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_77adecd9ce07503af0a625333c152251_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_77adecd9ce07503af0a625333c152251_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD521d62bb5906ddac87e9ccc5e67dbb7ea
SHA18c990b5660d050923cccc8faa30a669a16735402
SHA25682563f43453edec42b7cacf61111e52ee7b4bdc15f2c3e134851f37db537513c
SHA5122d436daaf9bf5e464e01409547be1bc18ddfa7e6bcc9fc53f44d91de9c5f5afe0c242ad4464e816f6afe73e30fb1cb2e413154d2538333b1cb25916e812ca0c8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB