Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 10:17
General
-
Target
2024-02-12_d2218d79bea91f60f99be381dd663dca_cryptolocker.exe
-
Size
117KB
-
MD5
d2218d79bea91f60f99be381dd663dca
-
SHA1
fb786511439cc34c3e44139ccdca94e79251eb5d
-
SHA256
1760d3739bd158f34159c02baa4cab24a371078fcc0536f0c0316ce0991d350a
-
SHA512
b0479309d778d1781849e4e9c544f14058584d22f2b5930ec8fb21e179a95e0d90e658df3a3586fc6e28c2e518cc4f6894f29783a3c6701b8255a11ae10c7d9d
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01F:z6a+CdOOtEvwDpjcz3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_d2218d79bea91f60f99be381dd663dca_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d2218d79bea91f60f99be381dd663dca_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5cf008921392a3168d3703c943d8b868b
SHA107017e1cd14eb911d446b6eb38d62d34f7639225
SHA25675e1991716b98d77ae0f0ac768eae8a074580bd7a6ab26f6f4003245ac34af1b
SHA51287e5eaeed0ea36e2fd7800738cc2fe9f17e0c6335edf946d91fadcb8ea8ebead758e7135c7e54dc3877e16116cbeaf1ec8a8415b55a809fbe41ac5936c6ce2f5
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB