Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 00:23
General
-
Target
2024-01-28_1130dbca9a334352e2c782eb0ed8c104_cryptolocker.exe
-
Size
106KB
-
MD5
1130dbca9a334352e2c782eb0ed8c104
-
SHA1
e63e5c18d13bdcb4fb745242069361190fac888a
-
SHA256
ff8103003eb6a23c5d2c366941504077e594f632f7a8a5284b96edeb672eb92c
-
SHA512
9d6ddf87d6f2551883a812816a3366be65949fbd7474a109f5895996fbc49451871ce0621b03e6d4b31be6212f1f180ae192a3dee8b9b60c8b16d4336a995b5a
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gkszfo:1nK6a+qdOOtEvwDpjc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_1130dbca9a334352e2c782eb0ed8c104_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_1130dbca9a334352e2c782eb0ed8c104_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD52d0fa1f7d441c5f8685ae076bb0ac57e
SHA1b667d2f8c79c1448904c6ad67b498fd720652956
SHA25623aaba4c433b2b42c59232a074ef81d61ff2ef3591915c5cac69c7d4b00b02f9
SHA512667bf242b11c68b6721cd4849c7d1dd94c8e98ac085fe01d6a523421f04b0119393cb93f398bb29fc2f0b0e4f52593373ef50ad9250ade4c936ee8ee67a0a6eb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB