Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
04/02/2024, 12:44
General
-
Target
2024-02-04_d02d30766154d1cc31def1fd68804f6f_cryptolocker.exe
-
Size
62KB
-
MD5
d02d30766154d1cc31def1fd68804f6f
-
SHA1
5ef4a42b0f49cea9bb313e65a53c49a032bb94c9
-
SHA256
27687748acd81f04168d6de292272c3764ecdf0bbfd08b67013566f30966beb4
-
SHA512
ef8cc21415ce8c0a06575b4f608fa059b916bd1a4ad2276da12e9ea490b3d6b71e1238ccf68a5c599480104865076ec7c0c482e5191af1b25fbc54b3507635cc
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAo/:1nK6a+qdOOtEvwDpjB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_d02d30766154d1cc31def1fd68804f6f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_d02d30766154d1cc31def1fd68804f6f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5693c48777620da6b3028ede123b43141
SHA1ea389395943e06c12d16dbd69b640720675ca621
SHA256964b08cab9ff0550796bdb59d500b9fae8013a6c49d486128c5afe55d041f669
SHA51260b64a080b4f2da8c3be29cc044b699ebeb09590275a96d12d6504fa80fa7405f61908fc2a84cc85c197dad4f1f1e881c09aff35aaa8b412c5776d2b2205ee59
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB