Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 04:59
General
-
Target
2024-02-18_b7b32dc093ff0394f3c3c15eb294839f_cryptolocker.exe
-
Size
83KB
-
MD5
b7b32dc093ff0394f3c3c15eb294839f
-
SHA1
8318f7e8af2cd22813e8e503fb4d88d18146cf73
-
SHA256
605836d3ad17aa79b236383a570bdf0788646d043afb4bbbcba005bf8f3c1521
-
SHA512
64c982d55f4c3e8aa582747ae2931e4711109f4738b9bf20d1113432fe78f942c8e0255f32043529508cf8c292ab0434ceae6a74ce6efdc239d4b60a59235dc5
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT7po:T6a+rdOOtEvwDpjNG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_b7b32dc093ff0394f3c3c15eb294839f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_b7b32dc093ff0394f3c3c15eb294839f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5b2a2b9f3a7ef295f2c3fdc9b0b59c435
SHA159fbb7919d3b7ecc590e1ca99115ff930b2a5269
SHA256ee2f5b0fddc8b570beec60756f7a3c883100dd4a1b47df78a98bb2221c5d5c30
SHA512c306f6cb1342e78cbf7764cba23ad1d3d7ac1328556a54a6aa78022a002008e83cf16fd21f8223b8df95b4bcffca3514de066a35ef792910ccd611e126cc05bb
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB