Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 03:32
General
-
Target
2024-02-18_36cdb146b75b5d34b51671cbd9b244c2_cryptolocker.exe
-
Size
116KB
-
MD5
36cdb146b75b5d34b51671cbd9b244c2
-
SHA1
4addde8fa886951d15f3e79e6a55aabb0819374a
-
SHA256
06bab86ea8855ee296c63eef0e50637230b1e642b04a39cf8e0342b6b7184b51
-
SHA512
ce4f28600678d43f8ac5055f221a7b07fe3504db28d77d947237d01f0a1ab8f2cea56e80291bfaf3e369846389636c576d2b445d3b91e0c828b640915da44aed
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01H:z6a+CdOOtEvwDpjczV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_36cdb146b75b5d34b51671cbd9b244c2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_36cdb146b75b5d34b51671cbd9b244c2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5a3b58ad44dbd08654e5ea37af8024bf5
SHA1898d20a56cdfa85a9993c4f3f428b83efa51ccb9
SHA2562b8e0e9fd41e5e8ccd062468da639bc7a51df69ec56eb2ee3aafb6f072118066
SHA51213b7e1e859efc2ff56c9c35233b5f63eff69b90367c4dbd0224c4b64212eba00ce2439f2b6a550e0112fac8205faaa7b2b4322a4b523e38d989657ae23b307f3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB