Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31/05/2024, 18:54
General
-
Target
2024-05-31_3407d0290ad0a98d36450cbad021e9ec_cryptolocker.exe
-
Size
90KB
-
MD5
3407d0290ad0a98d36450cbad021e9ec
-
SHA1
efa7d66e75052b2cfaa5fb6be1712b45d4461d1e
-
SHA256
2a59bc6aa4acb254b00220128f2c841cd060861ed2ef8c9295f1a85dd04050af
-
SHA512
df5be97aa52df6c65d353e4a79fa5ad1fd9dc5112a1131a2139bb9af9db221ab2ff391d1771d72cd15b4e1a62c0b861c67e3e67cc476aa8341f9ffcb684ba0d5
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/d:n6a+1SEOtEvwDpjYYvQd2P2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_3407d0290ad0a98d36450cbad021e9ec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3407d0290ad0a98d36450cbad021e9ec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5d375224135b70aebc5fd785b48cbd577
SHA1bb47a6d0e5a556d72cb5ac20f9b4d5a0090f5c3d
SHA25640abe4b6116e0752e084fc1966434637f098fb617ac2442c5e967c2f8037c1cf
SHA5126a89fa19f630004edb9509f42724f900e21b03262f0ec7ec1231f6e3f101cdeecf80fdcc07fe0693777b951089af7f9e60689c78c655f13463782756a4db11b8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB