Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 12:25
General
-
Target
2024-01-28_2b402fc99dfb3d77eef9ffcb7588df44_cryptolocker.exe
-
Size
74KB
-
MD5
2b402fc99dfb3d77eef9ffcb7588df44
-
SHA1
0e1403ffc75ac8878c4bdedc30742fad8419e311
-
SHA256
087ccb781e40ffcf0dd75e3fe843767f435a660a00954c4a5f94e56e02d02296
-
SHA512
765961893fffabaad6c15b04f57596caecfdffcb3f60193331cab70d568eb0c55038442c4e409bac78721d11ba1406d079cfaac07c208f0cf324f2af8648947c
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxi:T6a+rdOOtEvwDpjNtHPR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_2b402fc99dfb3d77eef9ffcb7588df44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_2b402fc99dfb3d77eef9ffcb7588df44_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5047492b9632b40bbe8a264777a1fd618
SHA1f09b56604a9249aecc49790440cd8b85d4b77fe2
SHA25600b709c8bba85010b17e5bada10744b2c820106e70ac9e87216eb790352993d4
SHA512046adbc0e66f2fcd271237ed943c5595242a3d28b540735b798d3ccd7909d0f86574c52ce361fa9aa25c7165a42e75849f053abcdf693614ad4d7b753dc5cbbb
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB