Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
17-02-2024 22:31
General
-
Target
2024-02-17_1e37e60a1651dddf2dbf07b94867e850_cryptolocker.exe
-
Size
71KB
-
MD5
1e37e60a1651dddf2dbf07b94867e850
-
SHA1
5a1accabcd8ba58d951b4dd19413f1758ba355e9
-
SHA256
ab13cfbeef94d29dab9f9156a867fa76fbe4eb590566a1a2bb0031fe90895105
-
SHA512
bfdb4b16c8001c5f081200bfc727a4fd4851413d340e53a88dc645f48d24de5f3a732cce09feb27c7c5a40db433e55f38e8452c998ee2827f60341c1ade18aa8
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalC:1nK6a+qdOOtEvwDpjf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_1e37e60a1651dddf2dbf07b94867e850_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_1e37e60a1651dddf2dbf07b94867e850_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD52df5a98c18f93d5f6ecc865b740254f8
SHA1e84368c00ca7f34f3f31029548f1f3ff17745416
SHA256ee748ac5a52376e22de51fc38a3ca16cae8709eea9e54cdc85fbab297f968ac8
SHA512992a37a2bc9b9f2bc85cf93d3b2b1f05d9eb3c1a8874c301530dd09904179a0567f7a696ed21ad7775914e84c3083ed03513e8213eaf31b4644ac1cfc9c7ab34
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB