Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24-05-2024 01:25
General
-
Target
2024-05-24_1cffaf83707e9c6aaa7faca986e2cc19_cryptolocker.exe
-
Size
59KB
-
MD5
1cffaf83707e9c6aaa7faca986e2cc19
-
SHA1
1c5a3c7bd05c14e1af6c6f52cd7b008c6255cbb5
-
SHA256
5b13812e39af08f51b104ab40d901fe4c4bb6d95fd134e373cf3546ab5821b1a
-
SHA512
a804e97f0e68a16a062bfd6eaeebfb823457a765f2b5221990cd3d538b3e7e466a2f5c55f11008c6b71f70dd806a96c6ebca6a704211b6692f0c544e76a46081
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPB3I:H6QFElP6n+gou9cvMOtEvwDpjCpVXYY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_1cffaf83707e9c6aaa7faca986e2cc19_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_1cffaf83707e9c6aaa7faca986e2cc19_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50463d046aeae9b213f20a7e4f467c957
SHA16e5ad0221bba0909a5c13d7c04a11e5948ddc9be
SHA256ce793f5f889a8e8628fae225ea6888eb11a4b00847ba5c06a55fad69fe416b1f
SHA5124a6c058a913e599d0d9c48c31946921a2307d3b90b9379d8ee2f167121f9d338a3163413b667ce0d34c23a0e2852255f194001611ada7023e86210446a17a937
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB