Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
23-05-2024 00:58
General
-
Target
2024-05-23_ebf902c7ef05fa767158c5edbd5b4462_cryptolocker.exe
-
Size
40KB
-
MD5
ebf902c7ef05fa767158c5edbd5b4462
-
SHA1
894eeec88992c065246b05965bdec5441edd740f
-
SHA256
b77bac988167523362851ef6942cd42b86d233ef84771f680859cfcfb06fd9d4
-
SHA512
5f854a8d9c4f0d3194e4e64b4af0b4cb40724f3e52e788fd8caf72d3c405e899fecf7200769142b457b2c34176f849eeed68d19712a3d2d7b08176d126dd16b8
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaB0gj:qDdFJy3QMOtEvwDpjjWMl7TdCgj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_ebf902c7ef05fa767158c5edbd5b4462_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_ebf902c7ef05fa767158c5edbd5b4462_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD558bb664b8de65654000ebbb407281154
SHA16a363a8c3223ab6a2d31c33555162af6560463fa
SHA256067e1db1a2f988128eb31165cbbe9889681a412f056c7614a7fd5538f7be9196
SHA512120a224375bb8df25a02722e48b2c7b2e15ee736a28865ec0d9c8328eaace0e191e703920560fa7d3db5a8e7837833188875c8cd01ab17811e0977b1b37cda41
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB