Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13-02-2024 00:37
General
-
Target
2024-02-13_97c565f5b0b952f8ee18b025c22b033f_cryptolocker.exe
-
Size
116KB
-
MD5
97c565f5b0b952f8ee18b025c22b033f
-
SHA1
87dba8147ceff7dbfc761c245f01fabf0b4d0bad
-
SHA256
4ef5d8b2a3cbbca0371784f6597302d60953941ff454c96d2b2f569234e014d0
-
SHA512
fecb69c1a7e3a2f0d0a677c36fbe4afe44f019e7456049b13dc5d5ef116d12f0ce709e362ab16490e7ab77600a7a58cf037a19841faf2f840f678de50fa61c7a
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01pr:z6a+CdOOtEvwDpjczX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_97c565f5b0b952f8ee18b025c22b033f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_97c565f5b0b952f8ee18b025c22b033f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5ec44ad785bfd4952dd824ec1f9a5f9c1
SHA1bbd3369531728b1734fec863692ac07841323a5a
SHA2563a8c84e3dcf6dcaeaeeca538f00cdcf8b8bc36ea06f1d2b783c4323eddd2677d
SHA51238b80c771bd1944a9216f70e7f837f4aabaf96ed1557d5ceaa6a72fd9d030616f1cdf2a006cb0e152d04510e4fa15278c0831ed3868d8b5c4f432fe630fe44fa
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB