Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/05/2024, 04:25
General
-
Target
2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe
-
Size
89KB
-
MD5
17dc357b9a0bec511d08f76196bec1e8
-
SHA1
38f5457542582c1c49d0105e4044a2dff40a8277
-
SHA256
9cc4cde6ac6ad892ef05f7945536b6c258481a79265ff444ea9d2ff1386cc4f9
-
SHA512
1be97b47d0e6d465524a807118231beb42664031b72164113e4b28f422609eda26d6347b6f512ea582647b117076477cc4beb41494099b1f5aea459eeef3da97
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIODwt:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD58f7c9b4245ea7c365ad0983476ccc36c
SHA1c0306c59bf3322a690b228f8b89c5ecadddec105
SHA2562d8fc0cbeeb8b43311f89feb528d99739e31e9c67acff2920da4812fae3a41e9
SHA512db3bdfc1d6ca568a157964eca2af72bdfb19de5fbb8a453079fac1171b56f912e995b774b0a3b91604084ca6ed83ded1aa90003287aaa784b9a09e27f343b8e8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB