Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11-05-2024 22:25
General
-
Target
2024-05-11_67e1b4763e8dd3ccb584d807fc9a9789_cryptolocker.exe
-
Size
39KB
-
MD5
67e1b4763e8dd3ccb584d807fc9a9789
-
SHA1
eab45eb8a3bb42556046d5e2b64b9323b468ff47
-
SHA256
ff09e2581d44fab14c6880d8ab3de7a0295d9ffe1379bd778bcc4304872e0143
-
SHA512
df67d8b979c020e43cb53b3171366b437460aa3160f9d6826d5ab6d7dc0c89c605773bf1d98d4b44657d6a60c04762d9904b9dd2af0a1d682f8dab7140524638
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY/I:qDdFJy3QMOtEvwDpjjWMl7Tt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_67e1b4763e8dd3ccb584d807fc9a9789_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_67e1b4763e8dd3ccb584d807fc9a9789_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5ab52861f1580ad7c41fed308343ebc8e
SHA1b4f3fb48e2534b7e94a6d1d883b9624fc6e4f2fc
SHA2562e7123025cd12a043a5bd9a04dbadba23fe5e448fb7396a1bff9f2764308fa03
SHA51201c19a80d436148756766d2547c15c1b709192afed929eb2b3c173b34a887ca472c1b14627a6ab2d2b241dc66d7b6aee52e779aacdd8cc5352111267f12ab939
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB