Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13-02-2024 08:13
General
-
Target
2024-02-13_c6f6ba753258533fa3ad68e473538f41_cryptolocker.exe
-
Size
94KB
-
MD5
c6f6ba753258533fa3ad68e473538f41
-
SHA1
5127e103a62706d8b16be1a8df1a49d7697e456a
-
SHA256
628dcd3d404bcd764c109594be652c5f7769c21e9461c9d250fa96c0615a0347
-
SHA512
89db464532d686172c68d011551ea3c86643603e3d22fda1273b8fb11f99bda5ab7dd75892a9e13908702d44ca2ce270781a57118bfa0a12cd4070cb8dab1fb6
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp015b:AnBdOOtEvwDpj6zH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_c6f6ba753258533fa3ad68e473538f41_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_c6f6ba753258533fa3ad68e473538f41_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD55122bf18822190042cbe55f921214ebb
SHA1bf42d0259dec87ecf2491be17de08435b5fbbd3a
SHA2560c5edfa682d3e0ea6bc6881218ae84508ad20be96d25bf879261493908e7e4cd
SHA5123b23f73ddd16ff539b0717e4fb05ff93004b8825e3d18323234baa9b235443cd0ab21a21760ebebfde56b23c4be87ba43dcac019f1c3b6855a33de006a5ae6d6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB