Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 06:29
General
-
Target
2024-02-13_fa286b238e9ee31d2ffb6b0fecfbd14a_cryptolocker.exe
-
Size
67KB
-
MD5
fa286b238e9ee31d2ffb6b0fecfbd14a
-
SHA1
bc46e038567a1ce602bfc4cd3d4d40823a8335de
-
SHA256
8160e8ff16b492e7669b2b38df261bb87a4b278b7f55e7bf887d82ad36279166
-
SHA512
c94b29a46dd00ef59da9b59408fcdc1c0ae6d1d1f556d194929156aee1e2e25bfda7b48e51c6ce4b1abee2d59730657875c2a3131e6f42b00480e4c8d4b1c02f
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBr:z6a+CdOOtEvwDpjQp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_fa286b238e9ee31d2ffb6b0fecfbd14a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_fa286b238e9ee31d2ffb6b0fecfbd14a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5023941c83c78ee96a3973631139a39b5
SHA15dc308bdfcac4a34e81a0c83d1a3eba344ab87e2
SHA2561951c2a336ae23189852c931d0c8f058ded022abd5498f54dd2df041225db485
SHA5121626c46e039096066aba00053208a41e8dd3a75535ea1175e466736daa69035ef57c226e7a5d34f6d28e69f8c9e279e2e17196f117f3d28d6717f0d811b29d93
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB