Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/06/2024, 19:53
General
-
Target
2024-06-14_649bd71a3409b87071e5f483d682a88c_cryptolocker.exe
-
Size
23KB
-
MD5
649bd71a3409b87071e5f483d682a88c
-
SHA1
00d53ff5862f881652f7589a01ec3ace7bcc0640
-
SHA256
51c88c97be8371e2e7f642befd574fd1e593231abe3e260f647672ab0a6f024d
-
SHA512
e5e15e154a5771dc46a87be7f6077b22c9bf06bba7699892179a1b9657b0c5de5be3d3c773e096ba9f95718d4bd15934647708107c6d3693d5edd9b8493ec149
-
SSDEEP
384:q7PfCcrtFecFS50xks3yNlitOOtEvwDpjqIGRYK13ED:q7PdFecFS5agQtOOtEvwDpje3m
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_649bd71a3409b87071e5f483d682a88c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_649bd71a3409b87071e5f483d682a88c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5b59372fd26de628c3ae4af96b02d2747
SHA18e6a749b0714f5427564d62d355ef350c1975e6d
SHA256f1413a7a806cd2855561cb163e995bd0c57a7b613c0d3eba481f7a278611e7e3
SHA512b6e15ddd22d4063cc5e8900d9217e8124a1b44297ab0cdc169c5ce0ece615bbf188ca6766782842db7433f99390bebd0b4f643e3415d0b0640646249351bdd3e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB