Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/05/2024, 19:50
General
-
Target
2024-05-11_155a2bcff758ac47d92b03fded051c15_cryptolocker.exe
-
Size
72KB
-
MD5
155a2bcff758ac47d92b03fded051c15
-
SHA1
5117a40c1103776c8ae49e924008c54c7f74f638
-
SHA256
0d8b550994a301925a812343954dbd511d74dd39415dbc8f34f83103957ef175
-
SHA512
b2ac74579cd05d2b3b757dcb660e7925d12acb4953ee04c0fdc46dee8258492c4c28a85643dce2d45749c070bc652de47271aca636594dd23da3cebfe3a7d6c6
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBRK:z6a+CdOOtEvwDpjQm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_155a2bcff758ac47d92b03fded051c15_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_155a2bcff758ac47d92b03fded051c15_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5f7738ab7c8dc33bfd0e8ef737459b94e
SHA15ca5c67819c9d5ec1054946e4fb580188d286f14
SHA256911dc434714dc578296fce0d2288c5c5524f0f4fdc44b29c7a274e09ffec4fdd
SHA512438612e3f8bf83c0a720c595fe8c26ad47e334541624c982172f4a78dc5d7aee54285fd8ab217272bfb26431818f039c8b7cd5833aa200fd129d913ec248aa45
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB