Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-05-2024 19:54
General
-
Target
2024-05-14_56b1920106a97f88c62af6a254525a5a_cryptolocker.exe
-
Size
39KB
-
MD5
56b1920106a97f88c62af6a254525a5a
-
SHA1
4001dd6a5e283e9eeab964727f7c7d801e8ea726
-
SHA256
14253d48cbf317374465e31f37e4876ec58c1031992e4d0d9cfc965ca76927f1
-
SHA512
ca67fee118abf82e216b37914e69c3b60d9aafd2c8a1684c9407496dd9687228367dd6a150c416cfac43a46bd3778fc780fcbf47dac56dbe6d099352f4f746ae
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY99:qDdFJy3QMOtEvwDpjjWMl7Tu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_56b1920106a97f88c62af6a254525a5a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_56b1920106a97f88c62af6a254525a5a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5cfd5cc8a48bd0baae3e9bc56095e4791
SHA1b057472f48377504588cf6bef24245ed888a4285
SHA2563e6b7decf55a6d8f58a8fa523b0e199ab35f120774954dd3bccf708a1b136ff1
SHA5126fe4cbd7edf733e6675c4f6096298d5b65a662052dd3de326112c7091cf9901d76a4acd59a000b9a0af25275c21451c622c9d4cbef197d9da7a8e52bc21142a1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB