Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/05/2024, 04:23
General
-
Target
2024-05-27_0347e74b51a79ca46b637545dbba6e6c_cryptolocker.exe
-
Size
90KB
-
MD5
0347e74b51a79ca46b637545dbba6e6c
-
SHA1
01624d8ed6f08baef89be5ff2546925e8aef5f3f
-
SHA256
b8a83ba3c20ac66ba4bafc4281bbea78f8a0389d60fcab984f9fa720f2149091
-
SHA512
93828c450e4785ff7e4e32afdf82edeb700a8d6b8cc31b49746d0dd9319ec1801be7d915cf24c7be6aae59f373ca1708cf2ff81de9c8a5bab00d53f837596a0b
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddD:AnBdOOtEvwDpj6z3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_0347e74b51a79ca46b637545dbba6e6c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_0347e74b51a79ca46b637545dbba6e6c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5412d301b74c886eff141e5fd30d22512
SHA17a68846bdd70aac2d6565fb4ea89a8ff57f22a72
SHA25677fd89728f5337ce376e6a17962e29ed2d487b698bdc7b9848a106e9a8b269ee
SHA512448d98329ec659e5e8823bcd7d4b3196cd6dd870d09dda3482dc6314ece9552c598f950d3cdbcd89d6ba30a629cb2977ae2b5b8be3f58344e00d90ff5779ce02
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB