Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18/02/2024, 02:35
General
-
Target
2024-02-18_781928bdf2e82c5c551bd27a981f6083_cryptolocker.exe
-
Size
126KB
-
MD5
781928bdf2e82c5c551bd27a981f6083
-
SHA1
10f2a69da0b5ff55222ea7841d18730f0ff6f023
-
SHA256
8cbde68cb9e8eda85b99ba11304f55840ce296c78b5470877a595d73ce70acf1
-
SHA512
458137c79d2e557ac8468c902f3dbd78e4738fc9a22c0a2323c742efb9291d1187da0899ce4242f05a40ba478e9b7a208d45023de674e3eb5cb78afeecbd59de
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eIc:AnBdOOtEvwDpj6z5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_781928bdf2e82c5c551bd27a981f6083_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_781928bdf2e82c5c551bd27a981f6083_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD593f5f597a98da23fa643c7b1f60d54d0
SHA18f6d71d157efd79022d3a17d1269b8a74e53e84f
SHA256ffa01d789457ef8fc81e18578899a0c52de9ee5ed43f3aa961505cf5362f1b52
SHA5124feb8719219a6babd31f7d0d4dda71b2ec5676271edb9ccb9491fb7534d0164a732e901f9c79844d878b76baec78e61738656416839e305a9a35e92e26777ee9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB