Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 06:44
General
-
Target
2024-02-18_982eafb06caa5e9d639c0875e94f0ea1_cryptolocker.exe
-
Size
106KB
-
MD5
982eafb06caa5e9d639c0875e94f0ea1
-
SHA1
2083dc52d535383f295042833886b8560aeab250
-
SHA256
9c0755b6734602fb97f31972e010fff1779208e701884ee02246ce5eb05c6494
-
SHA512
0c2a888e12a8efd30b711d90a4baafed329d1753ca04281fd12e99bbc5398b63cc12d73cf120b4d6c69c2c0a4e334cc8b9ee7a81fc58a625ca4c6b50583c25d7
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GkszfaM:1nK6a+qdOOtEvwDpjf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_982eafb06caa5e9d639c0875e94f0ea1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_982eafb06caa5e9d639c0875e94f0ea1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD56ac11a42e5f08f5cc1c06f85af8ffe9c
SHA118398df052e1170eab82e3c171b521c60981e818
SHA256da6082b23be3c89f737d85205e529bf2de8ebfff32bcc371229ce78d40ba8ced
SHA512d0ef623ff4dcf837c1bd8f73dc9d850dbfb9fddb74e2c21169f9fbf85bfe4002037cf668792853801fffa67b7d4c68415a5ac8716510a66a05fc3db4adc642a6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB