Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/05/2024, 03:24
General
-
Target
2024-05-25_077269a417b2cf7d91b01942cea00f29_cryptolocker.exe
-
Size
59KB
-
MD5
077269a417b2cf7d91b01942cea00f29
-
SHA1
93c0b09b8c9d1e6e4ba6026b4b1d69164f5f492e
-
SHA256
2f0ec4beab4b3f69183ba86e3791a6878c9a3718c310855078063b0fc0f86fbc
-
SHA512
9f1a1e54f4526f821f4c7882dc2321d316eda1339fff0e025a5a69a4abae80997a6d7725b0c89fb4e2d934a22912259eea9f04829318eec7a8bc81d08d9bc28b
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPj2:H6QFElP6n+gou9cvMOtEvwDpjCpVXn
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_077269a417b2cf7d91b01942cea00f29_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_077269a417b2cf7d91b01942cea00f29_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD59180c67303458e4f6ecc3dd4aeaa9526
SHA1254417bbd63a09c9d4dbd1ccb8f3d4a5f802eeb4
SHA256251f3ab30c07a6a3efa641b28519a5f9c0f344fbd7034941d7be68d7442903e7
SHA5128fa51e63d955ac4a590c00e103fa6ea6b8eea5c120ab9e78110cf4de1e8cc6a47851f9e8e7c569098b8cf5dd8086b1bb44a58417c5a0471eaf42fc60d48bc778
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB