Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
27/06/2024, 14:33
General
-
Target
2024-06-27_9b005579eab54e740e4b29f7abef56e7_cryptolocker.exe
-
Size
37KB
-
MD5
9b005579eab54e740e4b29f7abef56e7
-
SHA1
c37484e989b538955869095ec0537dcbf3aa36b1
-
SHA256
aae5ef3803d16e98fed30386c25823ee81a7d16e024cc14b07c5299e8427c199
-
SHA512
60d5e1667efe1b32b72ddd72b19643fb1e600f00bdd4a02b1ba3a64bf86da08abb285c2658640dab5c878a0eb4cedc23c700aa457eaa5c6fbd7d3a0d8d355479
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkIT2:qDdFJy3QMOtEvwDpjjWMl7T2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-27_9b005579eab54e740e4b29f7abef56e7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-27_9b005579eab54e740e4b29f7abef56e7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD585a96360a848e9e858a3ab3b8bc0f084
SHA1747a0499da547529d5ac9460d72bd42c7896e752
SHA256b2acffc675f66fec9b797c5c30cef556a864155b6b979ba7674ac64899eebb18
SHA5124029c72143612c1d0f605edfda4e476222acb7745526d29e77227dae043a0be252afb48c223bca19b9e837757ccddb57f0ce172d9987ae681ce3e2d7f9516cf9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB