Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/01/2024, 11:31
General
-
Target
2024-01-24_531a7ecb38617e626e27bad8bb932e13_cryptolocker.exe
-
Size
106KB
-
MD5
531a7ecb38617e626e27bad8bb932e13
-
SHA1
1eb4c03a9c7cbc64a0638570966ccfea0e0fbcc5
-
SHA256
d38d9466fec893b721325edda5cd485d09270a875dfc349c310732f9e6c6e814
-
SHA512
440df83a8fe7e5d8620414cbc7a850e54fd412ccdcf616cf57c1bda5ad322df3bbab57663e475ea1b397d26228cb86ec15ce76de4ef11498b6d45f1c963bcb4c
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GkszfM:1nK6a+qdOOtEvwDpj4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_531a7ecb38617e626e27bad8bb932e13_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_531a7ecb38617e626e27bad8bb932e13_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5a62f67688e5c34b11d988a950821d03e
SHA100d0b497518654a4f1a13010f4b7a9ec41bcf891
SHA25678ab259a02c14c2660ae7d3fc385d63b8b41c91eaa2d2662c49fe93ce25bb609
SHA512c7a1f5f048e52efb2e25c2ef791dbce5e212baa78cd8c6eed4898766e36891f8e6f2dad502a90064b6021ab88df65204e1a3bd8fb57e47328cfc94b1f5c54fed
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
64KB