Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 23:40
General
-
Target
2024-02-18_cd95b43a12b11efd4fcac11f0530d3c8_cryptolocker.exe
-
Size
117KB
-
MD5
cd95b43a12b11efd4fcac11f0530d3c8
-
SHA1
47fce96c2786c38c6e9d480f00d8612b14da4205
-
SHA256
1d1fc11f1cfca0dd4221cc40f9d3097cf65a62877e42fa8e7ce9462c8e68730b
-
SHA512
f3ded4ebcc985ade01866cb02983571c3b1ac047ae54d39a528ebe9612024da98515a2ad1c2c25f517cbe83ba06427a8d35faef98fb18151f1da1d9c050008f4
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01W:z6a+CdOOtEvwDpjczI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_cd95b43a12b11efd4fcac11f0530d3c8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_cd95b43a12b11efd4fcac11f0530d3c8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD52a928b6e764bbb0297db26d4f90dc380
SHA129d6b5a09541f32192a2b46cf061876fbe9e1b6b
SHA256d7177afaaad2c950cee0acd10c08582c23a0ed70bc76f95424aee934b2934581
SHA512c4cb1d99eba64cf8afc4919ecd2186b82ea85526f186cf4a5549b0f8ce0e8e5de246578ce0e243e374f958c298126e2cd3efd6d397a061f223b34eca82053e1b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB