Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/05/2024, 11:01
General
-
Target
2024-05-21_af46ad7461f3dcbeeb0f48b867bced95_cryptolocker.exe
-
Size
66KB
-
MD5
af46ad7461f3dcbeeb0f48b867bced95
-
SHA1
ab0cd81edf2eba4157824708b1b07a76e9e31ab0
-
SHA256
02df3c4e9ac1c9340f1976fc09691e7442dfd6fefe8d6a80511043eba1bbc343
-
SHA512
92a971251e3cf78809bc932250e366b8eb3c26a95cd7aa79a723e20fccfe9ba76df229f871adb8ba2d7cad6054e0e3fd4d3e09e6f358a671cb262ad36caf1403
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xgr:1nK6a+qdOOtEvwDpjW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_af46ad7461f3dcbeeb0f48b867bced95_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_af46ad7461f3dcbeeb0f48b867bced95_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5a09cd5a1937657cbad055a45ed7d9b43
SHA13a3dfd19a120f03056c35f84aa71bff72712d377
SHA2564e9dd53d9553d5de3be1bb26a26385d2a0479ceb187710b06cc86965c6c29524
SHA5121ffec51b04e9b80f79bba3f707fbf5f03a75cfcbee9746bba14a584040a3515ec34949550dbf2ae95c88fe91e637a94390ebf400e780c0201705376b3febec5b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB