Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
13-05-2024 12:37
General
-
Target
2024-05-13_9b3acea8cf5b4c16fca77212f94d3193_cryptolocker.exe
-
Size
90KB
-
MD5
9b3acea8cf5b4c16fca77212f94d3193
-
SHA1
afc3c57870ddbf57e3c84cc48838625cef2e8b47
-
SHA256
9e636850d823dbd7116d00ec6c0e2fea07c57fcc3770bcee35313bd2106e858b
-
SHA512
feba2214253954b3dc9c044e63c41be3a01903de535754ecc3d40c354b0f94ffa8fafffba19bbc5d680a263a4bb57d0397ebe0cb774be1d08685d06677ff245a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgIiJ:AnBdOOtEvwDpj6z3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_9b3acea8cf5b4c16fca77212f94d3193_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_9b3acea8cf5b4c16fca77212f94d3193_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5e9ccad62988bfd79a5f1abf5d9e5aab4
SHA1606e7cbefdb956b1626964d566b8d4bbcf652f29
SHA2565a687b992b493b8ae94ee753fc90bcfb81729a8d5ab446833ab30600a4eaea41
SHA512afd39ecd015b047bab9db886466e6d03451e6d6117c248ba2b5ea7741eeac617e35079d7690b716fb1a176b6e864e788161cfdb98b4eb184a0668f32e16dc0b7
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB