Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20-05-2024 07:02
General
-
Target
2024-05-20_dd1b111f1ceee531216db8efc0d1a753_cryptolocker.exe
-
Size
79KB
-
MD5
dd1b111f1ceee531216db8efc0d1a753
-
SHA1
f593dc1b7e642743b4601fb95923cc4a4fc073b9
-
SHA256
da482a4dd6529ca49e7deb1a0e49ad9374dcbbf2623d8b0249d918f74c3c3df9
-
SHA512
f41540cb5b10c8c8b7901650c7d9b59972b1f285fe4ade07ee49908f909673bb4e96bc9683dd98b362f6df3cd0fade60386844f443e54eef665fe06a3325e904
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdJcRP:T6a+rdOOtEvwDpjNt+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_dd1b111f1ceee531216db8efc0d1a753_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_dd1b111f1ceee531216db8efc0d1a753_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD57d52a2aa92943d71f0be59b547eecf52
SHA1d79855c8d485384a3d6908952b250030a20f371f
SHA256217fa6faaf10c1e574d4f80e04ecd3c846ad2b5c2a3697f76f96530d3574438c
SHA5121d17f26fa8a07c4798e175662acbc02c7832b8b58ac031e7ed4a8499f69c67beb5817f1c97f62fd3ed9e85147000d1831f2440b1dc1bfb5d48a4ea600fa3b830
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB