Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 14:40
General
-
Target
2024-02-18_9de520ba010b55b8e9320a663e3fa15b_cryptolocker.exe
-
Size
101KB
-
MD5
9de520ba010b55b8e9320a663e3fa15b
-
SHA1
0951adfff19ae27a097ee8f690a4b6e1ea22082e
-
SHA256
69e74b1ba51e992fead09979667f9b221762e22862f0bae415e5c1ada32bc757
-
SHA512
430a53eecfc8bd3ea4b79c54cebb1176746797c481d940a7f41bf9d7da0d5f7258dd60d351264397678ba4c37c5a7e45b201c386a0267ce009e75a6a73958ff6
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviy6c:AnBdOOtEvwDpj6zQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_9de520ba010b55b8e9320a663e3fa15b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_9de520ba010b55b8e9320a663e3fa15b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5e8694746789c5c40396063a7e9a02543
SHA15831a73e6dd696beea551b73f8a03a59854e4352
SHA256037a54049d9a48752d38dabcef615ca53f9d6567e98b14b1dcb820b26124ca57
SHA51269ce88aff9ddac8666d92ba15bc345220dee2df52f100aea6adf8eafe5fb5f26aef450c5635be3e78789139c6062b0d55b4a6fd7a1adf923ab21f419686a4385
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB