Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
14/02/2024, 00:01
General
-
Target
2024-02-13_014d0b4e91851d2f3660ab843f825418_cryptolocker.exe
-
Size
87KB
-
MD5
014d0b4e91851d2f3660ab843f825418
-
SHA1
8ea78c9e27a8634a81433c724d9f3ae6a2b9fce7
-
SHA256
5fb10cf73a1e1e6454be8e70a2862dd93e0c2e7c63c88fbc6e21a5c8698e975f
-
SHA512
16294e3e16b177167d1b81f6e878961046910df8d31d1b08cff48240857c053c426f0a52c2f00ba26debe85612ba7bb338999c0db601721e8a66a50cd7df0ea1
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIbR:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_014d0b4e91851d2f3660ab843f825418_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_014d0b4e91851d2f3660ab843f825418_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5e710f7a1d7ca1e95d0d01a7355f5c635
SHA1697d4cc2ae95e73cfef821617ab8a963f76cfa7f
SHA25692e37ec163e64dab206764d1abcd11cfc2ae8f48f737bacbf5103410f1eb7a53
SHA512e5df9ed933681e0084235d34d03fb6f2bcd41f680b4122fb047125fb84b95881eb0327d77026940d62a79a7b7edb72643158aaa4944acf752823edb5bcafede9
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB