Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 21:33
General
-
Target
2024-01-27_872c0c3d547d06adcc51cdb937752111_cryptolocker.exe
-
Size
95KB
-
MD5
872c0c3d547d06adcc51cdb937752111
-
SHA1
496ee0bb550f1881015daa98016078b4d6b3eb54
-
SHA256
4c03e656c59333d7e8a90ba5f5e4c617ae28cd24b05301283208df80912fe00e
-
SHA512
2d1ed3a56d95154743d50b092092508d51aba09403026a96f355eea335f4b4369c31dc58756165810608a4a0ab6bfd207089adaee299effc0b11faa938f6feb4
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01T:AnBdOOtEvwDpj6zR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_872c0c3d547d06adcc51cdb937752111_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_872c0c3d547d06adcc51cdb937752111_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD57e9085261630c72cdc3648fa27a2be77
SHA1f30ed03452dd25e95f450d66a68ac48537ba1dee
SHA25618ed3736f9f6bbe5eadb24a430ca586a7648f3cc44e726b621bb8562241bd012
SHA5126e4d0de10c6ab4680e4161010d9b024755edb805194ce00d0f6adc3e5644e0d7c8c6376eb4b230ff7969d4cd96b6f25628914bc57d8ffa23c259539be9d5ca0f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB