Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-01-2024 18:23
General
-
Target
2024-01-28_1142eaa4e6ccccb6215ddbaa8fa2f028_cryptolocker.exe
-
Size
73KB
-
MD5
1142eaa4e6ccccb6215ddbaa8fa2f028
-
SHA1
638e1b39028e61fe3f342b85cfaeb09fb70ffaab
-
SHA256
37567f9e3d3a8377cff676be6e4fab8b641e264fbc09277b5714a305c2e75925
-
SHA512
28e0f7a4c879d99064cdd8f14f1d3197c433dfe7fb2bcdc5b14a04f4367692debe61791a7adc486c324d82300a3bc1d0d41c33224c07cb17987729cdd33db053
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxuR:T6a+rdOOtEvwDpjNtHPD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_1142eaa4e6ccccb6215ddbaa8fa2f028_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_1142eaa4e6ccccb6215ddbaa8fa2f028_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD56a4069dd4480d2c634f9e4f831086a4a
SHA10fd3c6675b1fd59b8c4ec127da5e6a6eb7950f10
SHA256ba1cd424696979b5c1706c04b625945ac09d17cae169ff2f9ee9297a9f00ce95
SHA51258ad319c0298bd6bef2c04140eb9bf735e90692c0de6d851b62163a2886e2147e5d82ef27a151a4adcb9d327117b4394bf163f00abfe9e6b3bbeed470e5b1316
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB