Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
26/05/2024, 13:45
General
-
Target
2024-05-26_b1fb334906878dda21824e5ac1396def_cryptolocker.exe
-
Size
53KB
-
MD5
b1fb334906878dda21824e5ac1396def
-
SHA1
3818e765df965af4e466b8259f7366c842f86d28
-
SHA256
ba3d6e6894a7596b1861b7ec9ac85ed27595f6b01b1e8c932c010723ad2308cd
-
SHA512
2be4f9fb7b34c60e35746e3a27a25317be53d11fdea4405b31fb01935430a0e0875d3b641bc122c8a1f0472a0a881a9b42fd1186dcf7d59e34fe26af32019c98
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOkWK:z6QFElP6n+gKmddpMOtEvwDpj31ik1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_b1fb334906878dda21824e5ac1396def_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_b1fb334906878dda21824e5ac1396def_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD54c5c2380d4d3ec06f37336e8dda4dafb
SHA1db362cd9a77e0d6d77021a15d99c68dfe6743407
SHA2563b06d9493fc00a506ff98d52c2b4eb57c6e56b67fdd593e26e6955e3b3b249b3
SHA51228f1543f42593e46c13cee160c55cc57e84ef0478b2c4030b6aa66960defe4eda985fda9d33ebc2e86ae8132ea7ea1f52a2b602dcd49363899f211a3249e6602
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB