Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 07:23
General
-
Target
2024-01-25_15cef82aa8ab0f6a3e38968b9469deec_cryptolocker.exe
-
Size
116KB
-
MD5
15cef82aa8ab0f6a3e38968b9469deec
-
SHA1
ee47c9502a87bd8abf17986b0db3244c4554e79f
-
SHA256
442461307c1b896ca3db85523ab6cd42daa707bdfc9a83ca753064cedc04448b
-
SHA512
54dc88044f47cd5220c60ea2f6eaa1a016dc4e1a909ed9065502c3132cb556d8220f20ddb063eb385254c48d19de589256716b02a032c7ff79799be42ba3ff0a
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01kQL:z6a+CdOOtEvwDpjczP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_15cef82aa8ab0f6a3e38968b9469deec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_15cef82aa8ab0f6a3e38968b9469deec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD51dd03444846cebb697fabe466354675d
SHA13b6033b9f87cbd62b5093a7df1f719f6f36bd072
SHA256ecf87545e09775f83eab0694e3b66c6054d49b645a72d27029d93f47c4b91b66
SHA512a6056ce3a4dda16fd0ea1ec41a5547c3d68dc781479dd68f57d44ce16a482b0de4b7f484f66220275514a0852511b0da36a9fc30f947030bb64127b9a5f087b4
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB