Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
28/05/2024, 01:46
General
-
Target
2024-05-28_adfe9082734a5b84da014b038ec6fede_cryptolocker.exe
-
Size
78KB
-
MD5
adfe9082734a5b84da014b038ec6fede
-
SHA1
2b7e9621e1f0e1f3b06f450db31008e8134128a7
-
SHA256
bbb1d146e78de5da968d621b7f7a67e960f56397801d8406b49ba0866415812e
-
SHA512
60e5ba536b48b6bed3d842ef98160022fef76bf231c1bfdd5c867f89db68a5ddebacf2af9de8b891daa105207cb2dbb4adef4f95bc64607cf80961dd15dc2c23
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdJcR3:T6a+rdOOtEvwDpjNtm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_adfe9082734a5b84da014b038ec6fede_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_adfe9082734a5b84da014b038ec6fede_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5f06ec08f69f44bc1080b39e3feb02fd8
SHA12f080bb040e21ec47bdb71dc12aaa87ceadd3498
SHA2560ea0ba25a41417fa058c21bd6988293e838ffbb5d7bb6cdb32b835286e58a432
SHA5129c771c0b5a2200ed19953cc6bd6e05bd32ad41d84de93dff50dabd2b08219b82343bfd1bb03a3289ef2c4e9f78605ceac14e6507d21bc4c15f083bc2a3f7134b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB