Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
27/06/2024, 05:25
General
-
Target
2024-06-27_6cf1fc2e520e029abf555b5319b6a792_cryptolocker.exe
-
Size
37KB
-
MD5
6cf1fc2e520e029abf555b5319b6a792
-
SHA1
10cbdc74d5099e7ff1c5c6bf18a278acb07b807f
-
SHA256
534742a9c36f8f4306d5bab922d3628d97f2951becc52b30323c00399bfa9a1b
-
SHA512
436b963265548d24cd7ad78cc46da2768fd800d236dcee4f6cbaae103f15269384261ac545fa3482ac54e539bc1617d74a6e233ad253f1c808c1568f78a76529
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITv2:qDdFJy3QMOtEvwDpjjWMl7Tv2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-27_6cf1fc2e520e029abf555b5319b6a792_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-27_6cf1fc2e520e029abf555b5319b6a792_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5ef336ad33a406ad0bebe3b06a482762f
SHA1fb0908f84119acefb3f9c31586f8a18ed7c2228e
SHA256b87d561857ae2543795361dbac18909315c60a5fc18e1cd954395a2f35cd8b8b
SHA512ba6f60e56b13ed7edf96342326e7109fba7db729271bef9ab8cdabbeddcad379709d8e0bdcb48cd1de0f6482cd2b23c8f83acf5cc84d922c9c49f62a52e9410f
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB