Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
03/02/2024, 09:39
General
-
Target
2024-02-03_d458816b7d612fe82716796675eeef7f_cryptolocker.exe
-
Size
86KB
-
MD5
d458816b7d612fe82716796675eeef7f
-
SHA1
8c37f6b75463a40cc3cf7d780d72b0c5ca9ee2d2
-
SHA256
fcb15c74f37e4a44551d2d7b22cd2f22330b5fb560141509f658d5decef6d834
-
SHA512
2d02e5178f06218cac240a2293838c0dca21b633b4dd2487a0e8753afd912a68f7b0b27eee4ac1caef4fbef4499a7c9ba700bded35f1aed3b0fe4d9462199b33
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgLH:AnBdOOtEvwDpj6zP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_d458816b7d612fe82716796675eeef7f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_d458816b7d612fe82716796675eeef7f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD596f54bfba379fb2edab17a7cd9a3bba9
SHA15722353a15ae3d5cd7afb3fc2e7a773166b459c7
SHA25669c6a089164d0f252dd94c143abc3a0d8d0cb9db38748ddd6a779b20da9aa263
SHA5125ad42654f0a2b653af1522d2b2e7138b7be127401b4d97686892e0fa8fa1c8a663fa3d2e4cd0eb9be8ce5a862588b9ea0c714f45ff0fcecb3e10e48c3440a66c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB