Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
15/05/2024, 02:06
General
-
Target
2024-05-15_c778470c91964e683bd5ccd2931b4adc_cryptolocker.exe
-
Size
39KB
-
MD5
c778470c91964e683bd5ccd2931b4adc
-
SHA1
0dc175811e3ba17ac381fd71d38cdcd576ec86f9
-
SHA256
b8133ad4327c255612d88cc3480ab90eac065c10ca78c6ae19afef43e830f091
-
SHA512
6a9eac4cfc9dac78d8750287010da5dbea98611eb16b8d1caccec0fedd4ef18a0dc57c18cb95ffc294443567576ca6663546c3859d86f53196d90664e402e41d
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBF:qDdFJy3QMOtEvwDpjjWMl7TdT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_c778470c91964e683bd5ccd2931b4adc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_c778470c91964e683bd5ccd2931b4adc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD55121fb87d1bedc8396c41fb8347f1838
SHA1739fb5360c3d1db12611f316b34a1d2203cd0e40
SHA2568bc4707dd03a7ce8a04c4df3ff5d6ede36f608b6af9435a51b97a848d1b5e9b8
SHA512d0f38490110e964e59ffd3a4c1318c658f740158af1515b3729806d63bf47d8ddadd73985d65a5b36fad0db02d13342e02d6033581c18689f2c56beb1400daa3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB