Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/05/2024, 21:25
General
-
Target
2024-05-14_1af6302b46ad9422bef250904742bcf9_cryptolocker.exe
-
Size
38KB
-
MD5
1af6302b46ad9422bef250904742bcf9
-
SHA1
57430e6de8870e1f30e435b113c47e64bf38f77d
-
SHA256
655eee17fdbf24947e0e98df8d1bada32fedaa4d792f9d56d1faa370e617e478
-
SHA512
771644e724c699074477a103fe5e722e1d25220d920a1fd3548968c9b4e8c1422689f1328b7a03e250db67fb812c180391997bf3a87b3b817a8e9f2eba62bfe2
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9ji:qDdFJy3QMOtEvwDpjjWMl7TUi
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_1af6302b46ad9422bef250904742bcf9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_1af6302b46ad9422bef250904742bcf9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD50bb8bac3c6db61759ec71874f7bd117d
SHA13c67cfbcdbab7bdebdbc1e4a0e60f4619367d88f
SHA2565d15a115397ac81e782e3928e14e70b4a846258bea38446f30629b37660d0479
SHA5122950bb364fb3a778485ad6db9c4e2d6d73314a217b81c3bea4c1d255575c2c04108f588bca2df899f4086354bf556525f490b2562e7daa03efe0f494b41d6cc4
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB