Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24/05/2024, 04:06
General
-
Target
2024-05-24_d3b7a3e1317720ba6becaf838b6b6f65_cryptolocker.exe
-
Size
52KB
-
MD5
d3b7a3e1317720ba6becaf838b6b6f65
-
SHA1
2456383bc37f61224877e5d8531e7ed6cb010d96
-
SHA256
1f26c0bf3c0caf5e04669b93ee7f94eb405cf5b9cadce150ac675df2222d5596
-
SHA512
780ec2e7ad3adf4b374c80923e1d57b9264e63255cd519e800ac5496f04fefd4393ceef8443dc07590a56a2bd24ad2412261e5d39137a9f7231832c3626f38a9
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOmu:z6QFElP6n+gKmddpMOtEvwDpj31imu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_d3b7a3e1317720ba6becaf838b6b6f65_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_d3b7a3e1317720ba6becaf838b6b6f65_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5752eef1afdb83d84b52e2d817fbd67a7
SHA1f7486d5e34d2ae9d699951565a8f6979293479ee
SHA2562bb0921ea339fe72a87f19817986de448eac0c61b6af1861ef5884676f7b9642
SHA512bd5db4a862318a01e396468e3ba865bc0478f5e8bc40ef447253d7e935a6bfa9f8e9c56ec18cf06ea8d1ab207a586f2085ee1fb82ad57f47ba99e4d1438930cb
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB