Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/02/2024, 18:43
General
-
Target
2024-02-21_94412ea67ab29339c891c90352263d75_cryptolocker.exe
-
Size
100KB
-
MD5
94412ea67ab29339c891c90352263d75
-
SHA1
3833168d67d2d66e3d18bd7d891344e934d7578e
-
SHA256
3b2d9a7aae743babe5e1dc6943b9b1c589d65a8b9ba0536903ebaa578b826137
-
SHA512
721fcb2c56eb62730543999148a5bfb300f23d6da414f447af1114c24b6230a5dd21a6299eef3d1d2e1c27acfce134dfb047621b6cc71df6bc6b362bed18e972
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviPeB8:AnBdOOtEvwDpj6zj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 7 IoCs
-
Detection of Cryptolocker Samples 7 IoCs
-
UPX dump on OEP (original entry point) 7 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_94412ea67ab29339c891c90352263d75_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_94412ea67ab29339c891c90352263d75_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD575d0ccab278de108acb36e63b0c3fbdf
SHA1d87a45915198e37af4926f6a10a8b2d5a0140577
SHA256c6b4fa31c61c1b4aaacee9ae0677699dd3002b9ee638f3407333028232c2f629
SHA512a9c1348ea79321539dae40d3ffdac7ee8536e48078f477afb07b9cfd5b6311ded8411e9570a0ca4f73c2d3f63e063f6d3e156bda9ef4a2ad5e7b73ade210a9b8
-
Filesize
28KB
MD505f5c9ea4ec2f479e6660bfe38ee99c7
SHA18afd3487dff9d98b94565e7c7c67b0a828c9c20b
SHA25645dbbc9bdf73007557e4cf95131bb2679943dbbaa2cc6534a477e722892b2fb9
SHA5126a4dc934533f3314c83ad52339107d7875183a292a73b3231eece6d120129131d0f7daf7f5e77565ac79fe164f359d78e4875e76f380c4f72ca4d8210f90d824
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB