Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03/06/2024, 04:36
General
-
Target
2024-06-03_bcfe0264838e409096c8499209daa8bf_cryptolocker.exe
-
Size
89KB
-
MD5
bcfe0264838e409096c8499209daa8bf
-
SHA1
8d78f5451b3b44374534c92e7a73698d80e3f0c8
-
SHA256
01a8c7a1e7b05cd011a120a5c1fb339e739546280b120f0b3e5205342439463c
-
SHA512
7be0e2695ca59f34673bc4ad4624aed00c7d12154eb6493923e10bfc7d3467c0f835b8f17122b655ad85b8b8aa84139a36199cb814990f8418ba505ced9ec3c0
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIODH:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_bcfe0264838e409096c8499209daa8bf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_bcfe0264838e409096c8499209daa8bf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD59c3de3a0ca8f658d3bcd3c5e5b9bb318
SHA1a67a92177c8288241b6313c9823bb165eb1b34db
SHA2562553b565d427c713b3313d968f7a4779f7743e9e899eced43fdc445529803392
SHA5121dee133b1969b812c69155b3e593d4070b0534a45157f8e4f7b7032084a56b4a03d4fba2443fe580e2a17246373d91bbcef8022b8011e2bc8ab5c6ed298d867f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB