Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
01-06-2024 09:37
General
-
Target
2024-06-01_b41279f572cc62d58e32aa9ae6ba8ae6_cryptolocker.exe
-
Size
39KB
-
MD5
b41279f572cc62d58e32aa9ae6ba8ae6
-
SHA1
37eedcb07d4a567b9f4c8ab845c717b39668ab9b
-
SHA256
efb623784a1042e11a41ffaee27af1a5bdaf9ea9326603a5b4adc26e31969384
-
SHA512
ef5dbe89ec47670588ff1c91f20fc9672d409a63ce4568e541dceb2562ff333c14b6cfcc67e9ca20fba6d006ee22fd331873196eaeedecba47347ee5bf318da3
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axK3D0:qUmnpomddpMOtEvwDpjjaYaQg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_b41279f572cc62d58e32aa9ae6ba8ae6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_b41279f572cc62d58e32aa9ae6ba8ae6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5ca6d1e76a98e706552b8545f417ecfd0
SHA141df0d42dc1c5d381b6300ddf9f50932a8d3c8ef
SHA2569df4f2065c7e2422b7513abb6edd3bde34cb3598c7ccdbc3a5e7dea051cacc88
SHA5122967ee14b84e9bb74a72d013551c148c9fb30a3e2a4646bd8f4a0eee55eb772fa6c99d284ad4ab6240e29da26d653c428b3d5253410dd84dedd0d651401c6fe5
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB