Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/05/2024, 04:02
General
-
Target
2024-05-25_9e97e5d32f03bfbee944a92e6638912f_cryptolocker.exe
-
Size
78KB
-
MD5
9e97e5d32f03bfbee944a92e6638912f
-
SHA1
7cdd61c612ec91289d04e65b6219fbbc49d25ae3
-
SHA256
4925ff3f0ae784203ad23c96961e12af0a1be77a15b48a5ec38900266336f146
-
SHA512
5d27c449a804611261c17e7025ffc7d28c2dd91c26c7040a5edef20ffc03d1b04652e927f3ed329e6334a98f47fe75f8672aa9ddaf0ee4dd1ac4f5f91be91450
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxJ:T6a+rdOOtEvwDpjNtHPy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_9e97e5d32f03bfbee944a92e6638912f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_9e97e5d32f03bfbee944a92e6638912f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD57dc6d2eccb684c13bf21520f0893deeb
SHA150b392369f071c3d9e9bff4893f920a7ebab053a
SHA256c6760675ca36d16262e59905c92c0206b63eafd1bc1fba9eb3c3146f458af365
SHA51223721ce8aedd73f6cf60f26ceefcad5c3f7dd0729ec26db985ae3bd5a6983e3a14ad6a884014d063584ded3f4dfd905f648b8805e85af4c92614c2e5d9fb26be
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB