Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/05/2024, 18:42
General
-
Target
2024-05-21_906207a69f20409d7e021e102a696fc6_cryptolocker.exe
-
Size
89KB
-
MD5
906207a69f20409d7e021e102a696fc6
-
SHA1
fbc4499f11cf411c675938c4d0d991e8d8f203ff
-
SHA256
e34b57549e906260cffb3975a894e854b4f9d12062dbfc5e2ce874b9c9e184b4
-
SHA512
3bd947b668af5423bee3ff70655d36c2ad40e6c3b753846a9300b0c7eaa38c21c5d6429e61dc2e7f91dd95fdc2cfb9dba41df579cf197345bd7ef620654ece38
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgF+:AnBdOOtEvwDpj6z0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_906207a69f20409d7e021e102a696fc6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_906207a69f20409d7e021e102a696fc6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5a22b8fa07a3d8ffac74fd658381f4505
SHA1481d91710322c2cefc33008d9eea89c3697d90a9
SHA25673d58d70b31d28e6c054847899ae9c742356dd00fb50f83fc8585f73554232bb
SHA51217a04be8961dd9b1a819153bfda41a09b804daa10927e39b2db85d6054d409f94a1a1fb80f033248449148ccb02d5b511a8966ce0a5ad7a842aca19d783fad28
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB