Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
12/05/2024, 04:44
General
-
Target
2024-05-12_dd60df87a17522eb8704f899cd717e50_cryptolocker.exe
-
Size
39KB
-
MD5
dd60df87a17522eb8704f899cd717e50
-
SHA1
af62ddb86943aed37296f7a3b6bb5b28c9b366ae
-
SHA256
c6f1fbc784361774c21f23290d7f8708d95c185c7d5948f80657e5076058cbf8
-
SHA512
a21c6e7afd81c7785ff91a75f36709051bfff5c3ad5955ea80b017bb159da93531e2df3ba78e356cac8df68734a3451c18fdce8eef4251580841d4f01c7bc77b
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYo:qDdFJy3QMOtEvwDpjjWMl7T9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_dd60df87a17522eb8704f899cd717e50_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_dd60df87a17522eb8704f899cd717e50_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD59700ac727b4eb9a02200938a819f8f59
SHA1f2e3f579b76941ca03c40eefdb7609febca24895
SHA2564b7d590f97ef67ed624aff4febedbd7eaf9b309f46e90ad39d5b8ecbabbd775a
SHA5129f8839b29d8485390422216878328241dd654eeefdd92c1e5802845e2ca54bb5e421df08e58bd846028ccd62cb6f0b864a07d21926ae474eabe870ff7a129ff7
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB