Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/02/2024, 11:22
General
-
Target
2024-02-11_1e673703648bb203119709066089c2bb_cryptolocker.exe
-
Size
116KB
-
MD5
1e673703648bb203119709066089c2bb
-
SHA1
1cc7d947f725ad37bb600714bad47b42bed803bb
-
SHA256
ed36e1d2fbbb936fb2e7673ba4afddb4a403c2b281af79bbb4a02c9b4468a888
-
SHA512
37b34e054b7930388548ee41b50a745404ce206d152de334ff97441884b4595a93d167c7f678068fec82c78bc4ec1c72e28dfaaa3782e6a934a754d715bdd7d1
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01x:z6a+CdOOtEvwDpjczj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_1e673703648bb203119709066089c2bb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_1e673703648bb203119709066089c2bb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5d00881f018dc09820aa0c38b33466285
SHA1d3b35e40aa44b889bb7ea7f8b081067d838152e7
SHA2566dc19307d8ba7db2cf4112bc6651426b34737aa87b5f14e82a9afd77efeac39c
SHA512b329480eb3443d1b3ad9ddb7cdfa4413408a38054a711f21c7647d47e0bf33a03447299d529040641e97beb317ed8b52c1381e16ee2b62b9c0f6b0dde2f311ee
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB