Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
20/02/2024, 18:42
General
-
Target
2024-02-20_13be11194e5b35f09900feea4c7e86ff_cryptolocker.exe
-
Size
57KB
-
MD5
13be11194e5b35f09900feea4c7e86ff
-
SHA1
ddacd99c252850177f10bf8eae0560269d1bde5d
-
SHA256
126c4b5de5754958026c8f6041d17d61945906068c48b3738b0764560514bea4
-
SHA512
8f42cc433612e1764bc04cf1cf38160ccf41d970411488a7b4b1d1b3637fef7b96e70f1c7ca21a029fc053e99b8e4a3b9483d08c691d83d558ffb3d1b174daac
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5app1uV:z6QFElP6n+gKmddpMOtEvwDpj9aYaYV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_13be11194e5b35f09900feea4c7e86ff_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_13be11194e5b35f09900feea4c7e86ff_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5c21940e56ce71ed51ca214ca916a338a
SHA1ab5e95420ac7b9b2e7c8628b4a68dd19893b53e2
SHA25626e9bf564f80f0d65a6751132116719cc8b75c9817a85967f5ec503f39e3a518
SHA5124d683680b7c412909f644cd125968e7e9ecd7c59169a923df510b383a5b80ee5962d17718c2e22682d5d54b63b2a5396a3b2f11b8a012a656bc0809a922c12af
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB