Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
09-06-2024 20:54
General
-
Target
2024-06-09_dd0909370af7ea8fcface8c0985eb976_cryptolocker.exe
-
Size
89KB
-
MD5
dd0909370af7ea8fcface8c0985eb976
-
SHA1
cb4249196116c46a37d47cd07788c307b5cc3fb1
-
SHA256
21d60ed3422857fb1657967eb8bcf56dc22af98554305cc226b1829934b4f4ca
-
SHA512
080f616fa05ea8a0f6d2169303f0628bac3fb8ad28d9451c9336cc9131999a97365c803f6470cab1194159fe6de15993c37e835e2a5c9422f51050d9509ff76b
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIODwX:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg6
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_dd0909370af7ea8fcface8c0985eb976_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_dd0909370af7ea8fcface8c0985eb976_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD53b08d2426b559f5529c716aae759d533
SHA188117aace70b306050ff16d59ad85524f251f2eb
SHA2566d82b41490f8009f94d62a9c6a6213e14f3771ddb4a51d6a7c336ee30d158134
SHA5120bf8008407d5abd873c4ec1b69e362592d53e21c4a020fa697fa0093078b9f9511e48904b58636155b1326526734087d3744d5ea7867948e1caa36b9fdf09f13
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB