Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-05-2024 12:41
General
-
Target
2024-05-24_7fb5c8eb69b2e6933fbbec5d1dd8d6bf_cryptolocker.exe
-
Size
90KB
-
MD5
7fb5c8eb69b2e6933fbbec5d1dd8d6bf
-
SHA1
6ce12cdc3918367904321a0db965cc276f881cce
-
SHA256
3e8b022790b469765105bdd7781276b4386d994b4168a00fa8b1fccd8b071ef3
-
SHA512
55a8814af221c158d786b72e513133e47275943e899570beac0e7b627b3ece0294c0a839edf83be356409df8374d820355931503d8e99f2c0ef8ae5a6b0e98f0
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/B:n6a+1SEOtEvwDpjYYvQd2Pa
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_7fb5c8eb69b2e6933fbbec5d1dd8d6bf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_7fb5c8eb69b2e6933fbbec5d1dd8d6bf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5a33c6aabfda86bdbebafb164bb3267be
SHA16bf98608e0fc20f7b2b895174a92c6d279422e78
SHA256a60a9026efede0a66b0b4fe859c475d7320991003f875727e2c27c5356cbd0d3
SHA512e70eb55bfd55b00116f68e9a07442c4b8c72d84a7f69e62f709619e39d649435baa37487ee9591ad910fe82b7debc8b4487aaf34c073e2118f452e66c4fb6a2e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB