Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 07:23
General
-
Target
2024-02-12_09e9889d3ef19e8445020d20e13cdff7_cryptolocker.exe
-
Size
86KB
-
MD5
09e9889d3ef19e8445020d20e13cdff7
-
SHA1
0a488cc05d7080451d9b60630c6f828dfa2f48f4
-
SHA256
0383cd847859a5f7906ac545cdfe520279368f7bffb833cef4f71d6ca44f97e9
-
SHA512
c34ccfb2cad38793e2d896eea4ff2f44edd2a5d2416068fcf3d41873391819a4439f99a35868ccebd5cc2d85020052322493ad00c1b7fe85d7c1cd2a30a81891
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIJ/g:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_09e9889d3ef19e8445020d20e13cdff7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_09e9889d3ef19e8445020d20e13cdff7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5d625bf186c32703ec5d07b646b884b98
SHA1ff873e9207f19ca422dd6fdd2c1104c76b91c583
SHA2564fab1218f4597fc09ec9cc2184aade2f38c39926eefb22b7a8a897c4b350246c
SHA512494247788f129d3d67a8c254429c3efb2b19ac2d95d3dc965ec799b2cc06f6fd27f2950b6b60a7341c93fca43abb5abbe55a13d3682222ae22d4655ec1300d68
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB