Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-06-2024 19:52
General
-
Target
2024-06-11_e53902bce11ee80d711527b244948a86_cryptolocker.exe
-
Size
64KB
-
MD5
e53902bce11ee80d711527b244948a86
-
SHA1
ed790bda020c74307c96af82febe738477c7ba5b
-
SHA256
e9f3a62ff011e7bf18aa2ab97e8f0a5c23ad5d8890d0bf9b865d699738bf8d0a
-
SHA512
c33584f74c3b7ca16a160b1124ba33bf3f482ed19be72acc7722bd5e2aae1c74f2bc78782380b7637846e23678e5b155d286a999838fed010beccce0f40c789f
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYMWRIh:1nK6a+qdOOtEvwDpjZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_e53902bce11ee80d711527b244948a86_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_e53902bce11ee80d711527b244948a86_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5d5446cb9a388de2ccafe082a7cbd5b1b
SHA17b93d7cae111267890b9fc75a7b11267246151bd
SHA256f565164d589e1586bfaf0a445a42806602cbb05056f8e899f2e1e4734ec83cfd
SHA512536053713ea1487829d151ca3993148a57a15790d96b3c65e3f31309f2711fa93abde543db2ece7fbd9a5b792651c7206c55c87b789f53de13ab36732bded7ee
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB