Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
01/06/2024, 20:32
General
-
Target
2024-06-01_4234320016024ca562bed7ed59f745f2_cryptolocker.exe
-
Size
60KB
-
MD5
4234320016024ca562bed7ed59f745f2
-
SHA1
b4efafe6bb87557d92be8b1f4998fb02e43deabc
-
SHA256
92b15d66e531d279b15a03db8eba6c1161c37c2446971a2499793fedb14bfabf
-
SHA512
c30bb024379b415b2ddaa0002533b9ff191d3d218dcb862583a3f1981be8d10a7d95c6cd75872ca5fd333c12fbe561aa345cb895d0a711c498f6c5a3c5466744
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPjk:H6QFElP6n+gou9cvMOtEvwDpjCpVXB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_4234320016024ca562bed7ed59f745f2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_4234320016024ca562bed7ed59f745f2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD52d1a056cefbb81b97b7e0dd036374120
SHA1f608599f83722fd9b175fd9ff7ed4f4dcc5e7354
SHA256c7af9ef1a86115629d19b4e5cf924b65ef204ddd504048001d610151d496091b
SHA51227db9fc3a699f99ab74115f44acaff1f63f46777b437d3f31e45ab33ca24db9ed780dbd64941ab464399cdb68ce6fed43927df52141b49e75b67764d931e42f1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB