Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
28/05/2024, 03:46
General
-
Target
2024-05-28_83b41586382fed35caeac89328eedf5b_cryptolocker.exe
-
Size
53KB
-
MD5
83b41586382fed35caeac89328eedf5b
-
SHA1
7003171a4f7c7fca9f8f1c7d01cf535e6ab90ecd
-
SHA256
c3143fb1fa605641a0dddef52b7febb11e8285d3802a02a8fdfe45577970c8a5
-
SHA512
8632dea41556490dea921d852e16e76e5e58d4f2fa4a78395724128a5e69631ab9ffadf27b89b67e7c9c03bf2dbf67410dfa31b7b153c759047cda5813c83f3f
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOkgt:z6QFElP6n+gKmddpMOtEvwDpj31ikgt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_83b41586382fed35caeac89328eedf5b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_83b41586382fed35caeac89328eedf5b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD57b999b2da0dc6498f50637b8b52e7b2f
SHA1fb8b04da532cc3b3836e0f0e5ee1507093191ad8
SHA256e8dab11b9e8153fa9220156a6ac6862d8a78a37ff0d7f4e448005bf827233b90
SHA512dfaf9de7e6a8eac70166a59138bf9bec04be37035513a90829017695b03325c850df74abdbcaae40d09a127dab22335ddae4082cd82888a8bbf8812d4f9c6493
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB