Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18-02-2024 03:40
General
-
Target
2024-02-18_77604a2c7a05bd854b81a9e27c5724f7_cryptolocker.exe
-
Size
65KB
-
MD5
77604a2c7a05bd854b81a9e27c5724f7
-
SHA1
16140367d6c298578822ba45c537ace625c0aa96
-
SHA256
8bca1ff5a4aad33378ef7c26187297cb0f85805dd5b726751ebc7d2c2a751b90
-
SHA512
16f7b80b79e51ac533fdac4971e8525726abc76097c0999dbd7f11986facaa4cb6634af5a2c341b4465c2fa050cfc143e6cdfecb3345a646dc128e2569a3efc3
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYjc3CBX:1nK6a+qdOOtEvwDpjsX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_77604a2c7a05bd854b81a9e27c5724f7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_77604a2c7a05bd854b81a9e27c5724f7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ed9b576e2efa9bb55a7b69f09736061a
SHA150e49fbf5bb7f6803f02d2334d1fd54018706d08
SHA256b9dc6b31ae8e1547e7e046e984cedb957b4283a665da318b436197e6a7e5eede
SHA51272c981269893877b157ec5f25ddf20556e606ffc700156cd548e7a1919f4f56f1c11f7b0689db32cf96cbbdd0da2b9621c2ce6fbc59e8e4e5d521941d2053e0c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB