Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
30-05-2024 06:32
General
-
Target
2024-05-30_2d80b0f01ba71d059f6a6fd4a7e8c7a3_cryptolocker.exe
-
Size
91KB
-
MD5
2d80b0f01ba71d059f6a6fd4a7e8c7a3
-
SHA1
e56a62a8514500c0caa62038d74f68cc7e136bbc
-
SHA256
6f2ea47715f6af4c0d499a9138d262bd89dab4f7230d88fef3e8b6d3d995aa79
-
SHA512
e0d36a5de5d64730eae14d6fa1a9217c82ab4e82b262ebaff87a30c415c7b65a30897d2ee752b19f001c96b1cacf9a7b1bb862b2498284810e1641572b5384c8
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/c:n6a+1SEOtEvwDpjYYvQd2PD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_2d80b0f01ba71d059f6a6fd4a7e8c7a3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_2d80b0f01ba71d059f6a6fd4a7e8c7a3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5eded4fd4b4d706e5ec0be53d0b361bef
SHA16f29cae4fede1cfab2da697fc8e0d409e233da60
SHA256780be9718b975b108b9b9c9b7f20c4e6a92bbb4e812d56b7db884ff93c206191
SHA512fafa21ef5e5bac9b670f1e3ac7debd1deac0debf0c641601efb8fbf11b523a8bf5a78df9eef326efa224ef3d98b41869ae87b59ac419c3cd4e40610e6b666d2c
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB