Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21-05-2024 08:45
General
-
Target
2024-05-21_b389662594fe0b02a87e2402807016f9_cryptolocker.exe
-
Size
91KB
-
MD5
b389662594fe0b02a87e2402807016f9
-
SHA1
dd2e323fa549009800034752129f1da324b3d1d3
-
SHA256
a1eff05dc2d5435643f342ca80ac49557184e2b83d125de71e010207b2bea4e5
-
SHA512
ae5e472826c55cd8b8d7b8059c2b954b78d1631d15e8c86dfcbde5ad8d5fbcb8f9d657e3a91be5bc063af787948cec8977c5791887119d88e3f56db7bf833229
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddR:AnBdOOtEvwDpj6z1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_b389662594fe0b02a87e2402807016f9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_b389662594fe0b02a87e2402807016f9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD577c52cfe7d99bb899aa33f224e6f6b84
SHA1cdf823129e30085ef37c90395f46e763dde07e4d
SHA2566bb349ff5657cbe9f305bac106995670e907cfe06726f02fc37ffbb5e8c18409
SHA512c54c7a91541004410fbdce43b025769c1037600847544aa2fbdc5ea3d5cb58a691e70d6f666a925ba88e462c776d914703730a7d9ef6a798e85c09565e7b532f
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB