Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-01-2024 03:48
General
-
Target
2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe
-
Size
88KB
-
MD5
bbfc10142878645cc8add516b59f5d70
-
SHA1
bb3be464762bdcd38e0d8c3201825956793a0c47
-
SHA256
6477b7b1becd7ae6ea2b9cc93cb11f40dcfec3e0334f8f14f3803227f56167d2
-
SHA512
2d0c4cff28ba8e31b9ca909d617f318d91c6cb151a15a94b42ad72da22c9187d8b0d614a2a882365103051c9c97a9d68048a03aeb6ca88ebeca1d1b914e1d66c
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg1n:AnBdOOtEvwDpj6zx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD50a89d8b7f6406b8fe96ed7f4d30090e8
SHA1013e27e1362ce4cdbb36d14be63cfbe221e0c7cd
SHA256be6b4af2e85e992e574b659e12315a41beee9769cfeb59cefcb32cd3bd53eda4
SHA51211097f4a6f90e0623e1fc57bc47580a2c6161be90677b9db2d8de062227b0999359d86d79d83ed6ae7a7e643345cc2000e4a117c54b12dd9b6d7df4f3c6c0467
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB