Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/06/2024, 09:54
General
-
Target
2024-06-09_7f4886a388ab354cf32555622122f367_cryptolocker.exe
-
Size
59KB
-
MD5
7f4886a388ab354cf32555622122f367
-
SHA1
9138ac8daffcdc4e074811975638cf4d8e87f507
-
SHA256
2c11c0fe277eccfede45d66e38bd3a5d76e15f0eadc6273b0e61b5b6e1310931
-
SHA512
abedd7efcc929f8a7073d19a86dc456f3ffbc27f362f2649da7924d9b8c64bdffc655c661a4cf73e6860affac8f97baec2ead4d769a4bb02e58cdddd39cf394f
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP3qb:H6QFElP6n+gou9cvMOtEvwDpjCpVXhb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_7f4886a388ab354cf32555622122f367_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_7f4886a388ab354cf32555622122f367_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50f1141890b8d8a73927ea7dc88b627f2
SHA10cf1d60820536d6aedab1fdb236d72d9f5f3460e
SHA256ea1863a24321c33fa3f61ca85b638fa2cbe27a07eb515541aa5d29123904c1cf
SHA5124d79cf8f8455416d1bd066960281de3948080b0cff2908b9b601f33c709a5099eb3bcd323d3920818dfcbbeb4bcdb8269dc794483f3fcd4ff39b7b098e76b1e5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB