Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
08/06/2024, 20:24
General
-
Target
2024-06-08_024637f23dd75893c710ee85721f22f2_cryptolocker.exe
-
Size
92KB
-
MD5
024637f23dd75893c710ee85721f22f2
-
SHA1
add75b1b8ed696721a1fba88013b488d3b721ce7
-
SHA256
dc486ad96e64cad1dd7b207cded364c7a3380b3bf5ac99b3c898d253cf050108
-
SHA512
071d5634a06d271be0214eefbf3eb25cfe41b1e4f686b9cc6814aa373a98a50a77f79f442a15ab5166366544c04fb0627532c4c03b978b40df3530cf5b878ec6
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddAY:AnBdOOtEvwDpj6zj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_024637f23dd75893c710ee85721f22f2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_024637f23dd75893c710ee85721f22f2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f2a474d7c3148a7af478e68602d908a4
SHA1c84b8f1e22215a3f350fb6b84113b9e8cfa54871
SHA256c1ccc821ae657784a5a695c7d7b29b68313c206732a85aaaabd9dc0b5c5ccb4c
SHA512156b3ec94bcc3a10b13a7d6115a00261ac01896fa4c3dcd8ce0a78bf0c58a4627439de23d08014fa988547d5c26b0c9a5f92162a3d4d400a45fbb2c78d3d3f74
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB