Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13-02-2024 06:10
General
-
Target
2024-02-13_9aaf3697ee3cb40d0f3fef26c2943813_cryptolocker.exe
-
Size
101KB
-
MD5
9aaf3697ee3cb40d0f3fef26c2943813
-
SHA1
71c017c1bbfdaf158226ebb2a613e061c5b0bbab
-
SHA256
42b939ce56556135bc4e3af9d2d0d97bc2b666208ffc68793548a6f241d85bf1
-
SHA512
2a8aa4f0f0c4cb689d0983cf5528811adfcdb94a719ac442e9a273360f91d8fa80d14578820279dfcad92f93d60a997e4f922f721d4edd6cec7c0941fc78dbee
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviy6ixHq:AnBdOOtEvwDpj6zl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_9aaf3697ee3cb40d0f3fef26c2943813_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_9aaf3697ee3cb40d0f3fef26c2943813_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD59e2b0fc0b23cb2df7f884ad23bfd72f9
SHA1b47ab713da0513be59eb4a7c1132bebcdc0ba07b
SHA25654efd26c729b232da5feab88ad1f40881f821f707fcb1169b6562e305a4491bb
SHA5124327f3f91602ce4bd73e44b85baecd6f883d0821f58a3df1f65e506a926f432989e9111fd33c375c333b7349ae9c914a20de89aa75eb2175a21bb7de30a25431
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB