Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31/05/2024, 00:42
General
-
Target
2024-05-31_ffba5ca8d9c8cd80757790ffeb6269b1_cryptolocker.exe
-
Size
59KB
-
MD5
ffba5ca8d9c8cd80757790ffeb6269b1
-
SHA1
91aa98cf95495e2feaa9e1017640801b01e121f8
-
SHA256
569c510fbcfa1d911b4ade74b864848d72685810d1372331bb157db61272a5e6
-
SHA512
c733afea9fb6a9b35650e6ccefa22d6fada0ed558e99e078541c92d427adcc9caba8ee2a34a208503107b001bc819339a4b55591cde449b0e0e7b834d6a62d1d
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPjQ:H6QFElP6n+gou9cvMOtEvwDpjCpVX1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_ffba5ca8d9c8cd80757790ffeb6269b1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_ffba5ca8d9c8cd80757790ffeb6269b1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5547f3dc421d5724bc60765ffd8e35df9
SHA1401d6bced249c51c2d4fb4222844dddb3b577f24
SHA256870049cc7307c1553d4c9a87a5cd7d04a8949a1b05d1b0445edacd8b8c0d7b7b
SHA512f52c5be1370ad6502724fd513c8e2b4761d42a880d1c4ccf5ad2809a5a71e28df22f40e024649227db7a2387d0217d30cd3fa8a2f73627bf228108bdab9194e1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB