Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
01/06/2024, 02:33
General
-
Target
2024-06-01_e20851ad7ae395a98e461431b1181a44_cryptolocker.exe
-
Size
89KB
-
MD5
e20851ad7ae395a98e461431b1181a44
-
SHA1
d375cf4bc696a5ea493bd028f456befa132a0aaa
-
SHA256
a435fe7e1969ade30c96b2ad04ce304e33bb0b80dfc7dfeaa1306986347d69cd
-
SHA512
f63dce54898753c9d9340ba917a1a1943375be96997041651f591c00b56b8f64a5e77ddc426ca8b4fdf5df482065a72081c5283ccf4a209373ef1a27b4879234
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIOD5:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_e20851ad7ae395a98e461431b1181a44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_e20851ad7ae395a98e461431b1181a44_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD531968dac0b195e121c21e1bf43d79965
SHA1e2f10a5f8ae7deacc0c37336eecd349d927ffe40
SHA2564087c980ccb265dd0f6152e160044c48c5e289d3fc6c4f356962f5d523337252
SHA512625661136d4789947a4c0a359719ca5949972d56ccd9a40c62d73f80fbcf21666daa82379494e99ae73029adb9462d722aa0af3e7d2d33812134093bfcff1aaf
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB