Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/01/2024, 00:38
General
-
Target
2024-01-25_9f4ef7c605e1d4396dc507d7b1ae7a0d_cryptolocker.exe
-
Size
107KB
-
MD5
9f4ef7c605e1d4396dc507d7b1ae7a0d
-
SHA1
613b7f8e09e1dc08078fe630be5e10a1e81d7a09
-
SHA256
b2fcf89fa2fdd675a2e56e0412be5304c58741d74aa9dd56a23a37e193e907b0
-
SHA512
bb69b72e7b5ad230c87eef25e24c2dfade7bab7cf6ce20d36146ec7e148bb59c6aeabf0d054c8cfc150e5d4dbe52e23666fd900eeb8332495bdcd4a47ed70249
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksgES:1nK6a+qdOOtEvwDpjY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_9f4ef7c605e1d4396dc507d7b1ae7a0d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_9f4ef7c605e1d4396dc507d7b1ae7a0d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD5835ba2a85d6249baf149c1ce3184eb10
SHA141250dc6f3547be4c696cc56dfe9ad1b8e4a4893
SHA256b892477fcabd7b534feae9730dfaa4351c13e0ff74045f56656131827067e68b
SHA512d9b8f96cacb7c46aac40735a6f85ea1bb2e1d8fd0d28c09855e6eb70c40abd22d49f10bea68936951ead34f7a1d756ce908c36a6b23ac305be180fcbd43fcd22
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB