Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20-02-2024 21:47
General
-
Target
2024-02-20_fe60109d50ba518970b7f9b2f3e703c2_cryptolocker.exe
-
Size
63KB
-
MD5
fe60109d50ba518970b7f9b2f3e703c2
-
SHA1
bec316a5ddd082a437cb84682d0857102f1199d1
-
SHA256
8788b9bfb19402d7c5685fcffa227806f45225a14fe45bc875d5de6a2a02aae6
-
SHA512
9afe8c59dc740db1f07c87415e0975fa7ff154f95b702d5ced5352422c0fc3aa91ccc3dad8d7e1c801b6947e0bb5e5706810372a6ae3ce8b1a76ecd3c0814dd2
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAoR:1nK6a+qdOOtEvwDpjP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_fe60109d50ba518970b7f9b2f3e703c2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_fe60109d50ba518970b7f9b2f3e703c2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5524c42e4493c66f464def289ddec24af
SHA10d8360b3692b2de14452ee63fd7dd18b8ba2ab02
SHA256593c5e9a0dcee812ecfcc3acdcccf361c1de9d47fd8990f85e00b4ca4052f9bd
SHA512a7fdbf6a44b4a144002f0b8ef667056d86d16435fbded341aaacdb0c6e9ba6fb6b3cc7f69bcdc99094e256d8433c17174a43331feaa96492bd23dc45359af7b8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB