Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
23/01/2024, 00:35
General
-
Target
2024-01-23_cacfb41ffb93305bda6c57ac18b12910_cryptolocker.exe
-
Size
61KB
-
MD5
cacfb41ffb93305bda6c57ac18b12910
-
SHA1
f074a49270e415d8d882dca14aedc65b0e8b7fb8
-
SHA256
5eb8097f1c10201a486d6759d3c00733ca3d8cb5b2ef072419fb27a51b28f923
-
SHA512
f44823c9e2f37633ac95fa4f145612cfbe4272b232dbb72b948dd7fc0c6d9075b237c87b417d8ea2c83ebf81bdde8e19519c5f48451ed24553f4b142aaf2ca12
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYhPO:1nK6a+qdOOtEvwDpjz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 7 IoCs
-
Detection of Cryptolocker Samples 7 IoCs
-
UPX dump on OEP (original entry point) 7 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_cacfb41ffb93305bda6c57ac18b12910_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_cacfb41ffb93305bda6c57ac18b12910_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f1c5048b8502f1af0b050b0517d6fbd4
SHA17f255f014d23c9f07e906566e33d68775e65acb0
SHA256d4c0aad659d24d5693f051d24785f7726c01dd15b878acc669494a15669cc02c
SHA512c6540bfbc0316486c47a3b86b9900d7543796bb129833bfcf8d0a3ae06e28df92e92b721e94a368c32516d4c0e081e598dfd451f80e558f33e80addd3df986c1
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
64KB