Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
23/01/2024, 07:46
General
-
Target
2024-01-23_cb127c540dc3df4dad34c8387648e9d5_cryptolocker.exe
-
Size
96KB
-
MD5
cb127c540dc3df4dad34c8387648e9d5
-
SHA1
3064f359e346211e393c21ec5ef41991becc4e41
-
SHA256
4167965e1143fbb91870a210788bde4f520ffd32471767f23bb7d773905e18d4
-
SHA512
3cc90c19a203e934c5d9dcc1355e575551e14fe0e61e0f266e9f63f335e638292cd3c616b6bc739e1233df17ecba7a16cd616bfd25a70b55c14e029874ff7abd
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbbr/Bt:z6a+CdOOtEvwDpjcv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_cb127c540dc3df4dad34c8387648e9d5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_cb127c540dc3df4dad34c8387648e9d5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD50f7738d1b75f8becd487ee51ecfde154
SHA1ececbb849345597a70844dee3a5a8faac3e046d2
SHA2565e46462c0f76de6de985999145298ac77cb8e6af8fbc81f2aed9c162db4f7a17
SHA51229c5fde44d9b05ebec409232067f622d4e5990c36a438b0812930ccd4a3a8b900859d4daf45d4da9846457ad76277c42fd2380e22cb79d4c7502d784b4bdbf15
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB