Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
31/05/2024, 09:26
General
-
Target
2024-05-31_129c500722a515da281941ab0981dfbe_cryptolocker.exe
-
Size
39KB
-
MD5
129c500722a515da281941ab0981dfbe
-
SHA1
97108d41bf8cfbae94666d07157606126cbe67ac
-
SHA256
9a3afc53547d1620cb08a6ed5f6e572b45cd215c0039534b59795f29761b9554
-
SHA512
901fabf1569c6810f0914b4b751e29b34721d5b1109110cc6a132e8b34b720468c3283300cf52fc3943be9cbfc69462977afe0b7f5e226994a0ec9818c1689a0
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY90:qDdFJy3QMOtEvwDpjjWMl7T7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_129c500722a515da281941ab0981dfbe_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_129c500722a515da281941ab0981dfbe_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5df6c8a68441c36452a490e8f7d992403
SHA14121f6e86e6f1174ffbbc711eae79f063bbc470a
SHA2561faf3b22ede2858b3532f48f7520444b92fb11905130de5f1c989a96e65e7a27
SHA5126da02bcdceb06fd7faab3957785eda6b75ec5827084259ebfbe53554ec83204f9ca77c08c228b1cbde8576d6ddc38f5101528d772cf9018eb586a248338d0cb2
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB