Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-01-2024 11:40
General
-
Target
2024-01-26_ddc8f3578950467dced776d9dcacf3a4_cryptolocker.exe
-
Size
115KB
-
MD5
ddc8f3578950467dced776d9dcacf3a4
-
SHA1
f121d5bab3e92002b2cbf09f0083e8993f07ab82
-
SHA256
39dfcbad456f2094c62a86e6dc17de0a03eee27b93878df56fdfc8f16b36be16
-
SHA512
596ce35ff73d39bd430e5f9c8d72c5a27481a8b57514d532692da93723f2f7b78ca7ccd09f39cea3c1df5c20caadf0a346c0f86fa27ea01cb9b987b0a31b704b
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01i:z6a+CdOOtEvwDpjcz0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_ddc8f3578950467dced776d9dcacf3a4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_ddc8f3578950467dced776d9dcacf3a4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD505851205754875d3dabbbf192c82d26e
SHA1f227ace5774657e9645abbbe32fecd7c4a464aea
SHA2560ca7ffd1c419e7274b833bcf7d27258174e799ce467cf06573d36192fb00d566
SHA512b2550617c4e827bcb1f183ed4b1580da5be4b1ecad65a849ca1e826408632f19a6dc3397a5bfcb8eb8f22ddd36dd68ccb367c17ce74ada361931e96164ae68b5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB