Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01-06-2024 18:27
General
-
Target
2024-06-01_5dc8798266fdb13c830ecba13cf829c9_cryptolocker.exe
-
Size
24KB
-
MD5
5dc8798266fdb13c830ecba13cf829c9
-
SHA1
f0b8a32df593034b6a187e9d7ca9a34bcfa64561
-
SHA256
e2b0ecd743b55dd74df2f17c35581ea9dbc0d8cba821027314875947831a2053
-
SHA512
b18265537853f4fc02869863fbf4aad3bd91ece0495cfcf7f93bdf29ad718782c4a5ae4f7e1405e2f410954a1efad8956070aa3a5a94a815fc9291d804752c7a
-
SSDEEP
384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJT:bVCPwFRo6CpwXFXSqQXfjAsJT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_5dc8798266fdb13c830ecba13cf829c9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_5dc8798266fdb13c830ecba13cf829c9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD50199422d74cc881a038cea6a2dd1d03b
SHA1a712b1513aa89c65c18e6884d5f3e8c8a4f04966
SHA2565154a5eef66bbf0852ac7299bdfd47170f901ecc3a5d2bbc8bfe38d7e15b770b
SHA512f5f5137f3f851a50ba7a521d8868e418ba11963a894e2d59f66b052153f24479448f7f1a9e29b237960c67eac5d9fbf2b0afb7fc931cb55d8c9a789076520f17
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB