Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18-02-2024 16:59
General
-
Target
2024-02-18_e243218ea44865c58c3cef745280d79d_cryptolocker.exe
-
Size
85KB
-
MD5
e243218ea44865c58c3cef745280d79d
-
SHA1
9d60569728707f05619062ebdb607fc76de8060d
-
SHA256
6c4ae5fa3e4d71044b8c491912e302a658ce13b12ed9876b826b618d83404f5e
-
SHA512
5206f7f45bc87280f8fb45395a5a8fb85a287fd77b82d84b0a5b7b6b5a9f451c347a6ebbf301a4c8feaebce999170ffd6d3af861b6f69f640bc84e468ce58388
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtISEh:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_e243218ea44865c58c3cef745280d79d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_e243218ea44865c58c3cef745280d79d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5e4e1ea9c228470343b5f558ee7e2c289
SHA15b1a0940c1370c5a59d2251750b2c154348cabdf
SHA256b658cc784e2929483cd3f15fe59347258be6dc0d7582bbc29cd38ffc4ac3a3ac
SHA5120cd3fe95b4151293fbd1c06c4618bde3de6ff2718bbb64ca7eefc8341dcc8fd64ad585448d841c07a346f2d9c7414bcee615f6056223a1a9137318a29eed90b5
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB