Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18/02/2024, 20:44
General
-
Target
2024-02-18_891689f60caf6f4c948fbf5c8d8b1286_cryptolocker.exe
-
Size
104KB
-
MD5
891689f60caf6f4c948fbf5c8d8b1286
-
SHA1
4994f7318928c412fcbf6e11122dd9901c2f9db7
-
SHA256
2cb3042117143f7d5c7214eca4c5e1ae935f32b3e119a230b6439811f7136ab3
-
SHA512
cca815adb6ed67b3a9985792367d61f93307caa9b45b115b075a387fbda22ce518bbc029bee366351c98824d0c014c5f0ab49f24d87d9e4c055f29f13e1f5060
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gksb:1nK6a+qdOOtEvwDpjb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_891689f60caf6f4c948fbf5c8d8b1286_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_891689f60caf6f4c948fbf5c8d8b1286_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5b3b0f716e22d7b68588dcada4228d61f
SHA182bdd206f72b1b48c6080444ce9927c7b04d8538
SHA256b418ecea2336fad726c22538455ef4ab73c0793390a095fc6d5318d4d34d34e5
SHA512c308a2393eb53794ac5a6a8d00290543613d2084fe12e72beb95f28176414db2eeeae15b510c403c65e94dfc25df7bd70570ee851875d53355705c1adaa339c8
-
Filesize
64KB
MD56aa119e816fb18b856089718f0be8e30
SHA1a3c8dd0e01e22b01474d241097d7600f2fd61a1e
SHA256f53e56d202e50198f2a3c5cb6393e442c283ab347cebf21aef73b5c622e9e12e
SHA5127f8b4155691f2c7585e6537e0722ce37d1d47bf8c277044e0cb6776e6d2c86f1b660bbd0da91394ce06bf88147e3629e2a13811703072c5c33137271e8906a21
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB