Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19-02-2024 11:40
General
-
Target
2024-02-19_7a13c99afd9a6f83160247059ff083ce_cryptolocker.exe
-
Size
87KB
-
MD5
7a13c99afd9a6f83160247059ff083ce
-
SHA1
4a184289fa8977b0800cc7e73d9bba3901f5b818
-
SHA256
7c845b61c1f19f0c6923d59809290d73e7c5e3148d10c46285b278267fca19dd
-
SHA512
1149868950ab7aa17ae5a1596dde354e5a45850cb7f22505a594a281caf9ab7d124b55434a1d375b13c580961a5f196540f31d28b60a3966e02293a37c9b0521
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgLz:AnBdOOtEvwDpj6z7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_7a13c99afd9a6f83160247059ff083ce_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_7a13c99afd9a6f83160247059ff083ce_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD51bdf77d66387214c1fd7ceb3cdf78e2f
SHA18948251d9bcac9274e39c59fcb653f7d6e3cfa6d
SHA2564cc13eac454506fae25c685a3334942370e6a1efc25849e4cfb31080d2acf7e8
SHA512a08bf2b9631af290fc8b8a4476645c4e6f874499c06180dde5e32261f07dbacd3e80ca1ee531732be6228e4c94a4e4995b2264ebf2a26e7df698d529f0e81527
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB