Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-06-2024 03:35
General
-
Target
2024-06-09_3d0a8b2237045e51d62f2f464d84ade4_cryptolocker.exe
-
Size
53KB
-
MD5
3d0a8b2237045e51d62f2f464d84ade4
-
SHA1
73136974b69a800f4ab472da78b580e39a76f393
-
SHA256
336565d44adc8860eac89c39655aeab1e7f63d256002848b4968e02051416059
-
SHA512
bd05b067e42bec9a8b824b796772d88235d258950731388295665c814f3fce0c8809fc6ca6f36e02294b4c3bfeaf4b5137097122f0eb6f0d21eeefea409974fd
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOI:z6QFElP6n+gKmddpMOtEvwDpj31iI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_3d0a8b2237045e51d62f2f464d84ade4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_3d0a8b2237045e51d62f2f464d84ade4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD50d05c3b5bc2ff8e97e59ebef30ff4cd8
SHA127ce43b848f352419b90d7b8f30b1912f54be5d8
SHA256ad4a5a3575e20006b3af8364f9f07a6cdc0d08068c8f590a065d118c922f9f47
SHA5124882b24508d42b4dc96fd48ff09c14b2bc7d7a1779f5e57101764eb29f04ca86f04748f3deb659b00fa57b39e12526d4d92a8b057c70a886639b0e3bd7c97be9
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB