Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/05/2024, 15:02
General
-
Target
2024-05-22_c3c025c3c4e1ed4f3b73189417aa2281_cryptolocker.exe
-
Size
88KB
-
MD5
c3c025c3c4e1ed4f3b73189417aa2281
-
SHA1
e09efeafdb8d46c0125b3c9d96089052af2e8aff
-
SHA256
7362a44b37affd1f5fb54a7a8294d5558f741136f796baec18a67a07973b3df7
-
SHA512
fdf75bf99dde6a63f0d261682ccc734295c540681a8a5d040e3289906cf515860e6b2b81bc6e10c0a0eb08e9e0b38cd0ae4509fb0021af2b9700188e3fe551d2
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIODt:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_c3c025c3c4e1ed4f3b73189417aa2281_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c3c025c3c4e1ed4f3b73189417aa2281_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5439084dfa8af8e7fef36e8c599e97527
SHA1265b7d7cddb54366f8d622bd53721bd6a2f411c8
SHA2562dcf4f78d396842c9163acbc9a5e6cf371f64ba1e8d99c058543bedf2bd0cc4a
SHA512ef434a940810db6ce7c1e5cf2fb5c8c1c1a1683c96468d7c6de9ca5733feb822bde9ab51f3c8558180ebe89dd2cd906f3364a3a827324f4c80ee8adc5a906519
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB