Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16/05/2024, 23:50
General
-
Target
2024-05-16_31286f6c36b530c4a716cbdcbdc6d751_cryptolocker.exe
-
Size
39KB
-
MD5
31286f6c36b530c4a716cbdcbdc6d751
-
SHA1
33acaa9b0d6f5f3c23402f5c2f599b14aa0e88a7
-
SHA256
f40d1908754050f9856b43befa6beccad441669b7437be605764698e9df47dd6
-
SHA512
6be2f782a3af99465edeb1c5834678c375b690d8973db682666e13708c1309d203a529b65fd72cdbc34a2b0e92c25f8ae71f2b83ad99d939fecaba72158e8979
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYK:qDdFJy3QMOtEvwDpjjWMl7Tb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_31286f6c36b530c4a716cbdcbdc6d751_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_31286f6c36b530c4a716cbdcbdc6d751_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD54c27274ad6c93e172c1b4be2ea72e6a7
SHA1f656087594fb4246d49c1b9376f392b173494b42
SHA256406e30239ef36f5a1da4687653d2635c65710697552e100715e71add1de1283f
SHA512eeebecc46a2a17c197f957b365b18523023f92eae08f6f6142c0915932552ce32be3a8bb3d7403d0fd6bf71c7c9056e3ad601c93f177c87a58b3f239bd2ac50d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB