Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
24/01/2024, 23:42
General
-
Target
2024-01-24_87379d45bf19649f78f3e289ef02de5a_cryptolocker.exe
-
Size
117KB
-
MD5
87379d45bf19649f78f3e289ef02de5a
-
SHA1
e5bd5c7476bf7c2e1f6ec7ce72e1489c9b74cddc
-
SHA256
ecab2cc1ec7cae9ffb2be4fa297f63b932bf44c078ef54d75e553be43336a667
-
SHA512
e27f71f314b89a50cf6759b00d52018e33df0c654b5a2633272fc74105d38859d9db7b19ab1c27faed62ff79c6f193a073614d00725405d115d92f613558c719
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01Qad:z6a+CdOOtEvwDpjczH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_87379d45bf19649f78f3e289ef02de5a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_87379d45bf19649f78f3e289ef02de5a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD510482b2fc8d881e25dc3a0ff4c3d5530
SHA1804dfacdb6c8743f3ddf972cda0f1bcd44b05f99
SHA2568eb186fab66b3c62ff2daf45732d8ea903e0d6d7b7f4051c1dc1e532ef84b01e
SHA512c32d523d222f911b9105ecf7b64de60473288c8b27f4a155167465a9030326cfcf01c39aced3d14a0d9cc377a3aa8960e1b22730208d34e2f52c608fc00b937b
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB