Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
11/06/2024, 19:54
General
-
Target
2024-06-11_8c04d7da7dc82c52d17a7b1b1919445c_cryptolocker.exe
-
Size
91KB
-
MD5
8c04d7da7dc82c52d17a7b1b1919445c
-
SHA1
48ae6457dd8faec6d755d472e96ee158f1165119
-
SHA256
6287354b56b970ef27d4a2e28603de65da33626db814092fee76b0b2f7b37176
-
SHA512
feb04655db436fbc1c6027b794232b48292445988dfbb6f56fcfa6fd714fbab4c33c9e97d0e4ad73d4f77b2768da8197fe777c93114017647583b3df888da334
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/Dx:n6a+1SEOtEvwDpjYYvQd2Pm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_8c04d7da7dc82c52d17a7b1b1919445c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_8c04d7da7dc82c52d17a7b1b1919445c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5a5c70c74bc9f7df71b6e353d32862390
SHA1f52a5684fe9e1c8765d31593a75ad0832ad1b0e8
SHA2567c4cb9a8fc9548fe7ad4a80f9a3b0390f0c9d2095d33cbb1b8ecc5f6882e5e13
SHA5122dd3fa89ec8f703d042904655136bfd27f87751fa3c353e9d9ab25ca17c1e5316d6ea42941e5c4cfdc5c3b7f85dd2be845cf7445d5221090b2ce0c66657c35e6
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB