Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
28/05/2024, 21:47
General
-
Target
2024-05-28_f7d6429cac41d0be6ab5f90db7a26a0c_cryptolocker.exe
-
Size
64KB
-
MD5
f7d6429cac41d0be6ab5f90db7a26a0c
-
SHA1
5c3465a78d1cee13ac980356c12cb791f9aa0dea
-
SHA256
8bacc7c6de6c8974ecdaf65a744de149d1e1062901fe174fdaa93c2042fbb527
-
SHA512
9325bf4cd6963f86e4097a47f02a974f7400d7af846aeb7ec43a915b016872bf5403e5640fa08e88bd5940d3bc5e91c27acb853c6416fc23427281c56519864c
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYMW3:1nK6a+qdOOtEvwDpjc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_f7d6429cac41d0be6ab5f90db7a26a0c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_f7d6429cac41d0be6ab5f90db7a26a0c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5cc1b9d6b80d5f69b6f5a0ef7dc8faf8b
SHA112727b62eb7700dc531912200d92c33bb294795d
SHA2567d9c34d44c9f015ec0b7de50990426a7060036ef098128a94909f993b4e1e937
SHA51232bc59e84f775d91040c8e84cfc62776cd69869b7966489b8981508c02308dc5539f5f0765798ecf40a1d57115ab9ae2545dd87ffa890681af515e5ce8c4e210
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB