Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
04/06/2024, 03:26
General
-
Target
2024-06-04_260c109c93ebeec02b57b89800366f74_cryptolocker.exe
-
Size
40KB
-
MD5
260c109c93ebeec02b57b89800366f74
-
SHA1
d4937915c00ecdd0195c692864ceaa150f1d10bd
-
SHA256
4eeb28fcf8dd7857011765ccf829649aaba0635547a65ed36ced8496f8a5a5b9
-
SHA512
89b2a12a491d7d008ed9e393f560a29b713e1d1a1e0426fa34330231b6468ce1a0b44c261aaa7d02e1031bab0df7ced7e0507504a7e0b83512d4c14b5a4ad7b1
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYp:qDdFJy3QMOtEvwDpjjWMl7Tk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_260c109c93ebeec02b57b89800366f74_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_260c109c93ebeec02b57b89800366f74_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5f50a6caf7fbcc2d1d8cddaa633168206
SHA16bf7de7eda95724c87c8ab3fbf884bc47fa7330e
SHA256aa57c907cb051e50d58425d690ebcd6f9eb7c09e7eebace19d36c610a8b74396
SHA512581cb016f637c8b4d036c0b0346a8db6eccef4fea2617c0dd2be5b56ece7d1a0c79bf2435f1aadfe642e902f5596ce50c2fdb6fdbf637d55a27436c958e82e31
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB