Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
26/05/2024, 02:29
General
-
Target
2024-05-26_55932b06a9b9a384490d5fff88956565_cryptolocker.exe
-
Size
61KB
-
MD5
55932b06a9b9a384490d5fff88956565
-
SHA1
4e3af22fe932d8e50190c6dcfd6c20361b2b67d9
-
SHA256
ca1389f4cfb146f83c80b640c519af741acff10cc8c2e5e09c6c1efe7accd3c7
-
SHA512
403b9179087018c004076c32eaabb7ade0079029e450cc34edd87cb6b7f377feca161703219056bc385a2e884851a611aa45dbc2e750b90a40d333252d211891
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaUf3P:z6a+CdOOtEvwDpjQs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_55932b06a9b9a384490d5fff88956565_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_55932b06a9b9a384490d5fff88956565_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD56d201f0876f8bd817f7c87e8d8cd53fd
SHA11c9b077c11401d2412cc49bdb6fe7fe2a852c78b
SHA25630c526983b22932703f005976f68a6b3ef872b45e38838cdce01cfb2062d88a4
SHA512d8b12b6f0fdd2bd733e02c67075fb4a88c06ed9bd9fe3c27f586750bbe95be55e6224d69a885ead6bb05fe62da364432b9bce83aaec4e56a2f1c3f6a3e409f4c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB