Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/05/2024, 11:33
General
-
Target
2024-05-13_4db8ffb248043515e89cfe7061f9699f_cryptolocker.exe
-
Size
58KB
-
MD5
4db8ffb248043515e89cfe7061f9699f
-
SHA1
5d167c365caba6bab80c027beda30498050e001b
-
SHA256
6822f15e8c31921a4f2e528f8175ad435e76aaf54f9ae323a4079dda7f382c9f
-
SHA512
ae43ce22b513f6ea127d3c526b163bf818d3062ef2ff381416ffd43f089ebdc42b65dd06962266ae36adc468e0938c68428c44d0b709aa694bc9bfd5bce71ee9
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5ax+NL:z6QFElP6n+gKmddpMOtEvwDpj9aYa0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_4db8ffb248043515e89cfe7061f9699f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_4db8ffb248043515e89cfe7061f9699f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5585f1c6e97ff15a743b5fd38f95a75c6
SHA1289dd3cfd3316210bd4112971ba610cef566cae9
SHA256bf0263ade00a99a9b359256b5f7bcef7c35709ef28dbf17a81b137ee814853ea
SHA512d701a024cdece57b0b90bb00f1c4d12b9002ad980da6715e07f5cf8cc8c9339a3e3441db2397ff38e0fc5e3e2c87017a0cd28476fb0560fc186923b409ededf5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB