Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-02-2024 15:49
General
-
Target
2024-02-22_bbcd76f68ab979efa9465002be024e84_cryptolocker.exe
-
Size
88KB
-
MD5
bbcd76f68ab979efa9465002be024e84
-
SHA1
5c5928195be5acbb54bae432964d53296fb35f5d
-
SHA256
688a47c5c159f2227cf9dd173686f028151c7de9c94a2c08247e776edfe269a7
-
SHA512
6b0071ebc10696f6ee01e53c6b6b8f60683666204decc6e700d128214ac50f6669015822625584a0f684f5d6adfb3d69e058000124de186233113aa2ce0a4cee
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgSm:AnBdOOtEvwDpj6zn
Malware Config
Signatures
-
Detection of CryptoLocker Variants 7 IoCs
-
Detection of Cryptolocker Samples 7 IoCs
-
UPX dump on OEP (original entry point) 7 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_bbcd76f68ab979efa9465002be024e84_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_bbcd76f68ab979efa9465002be024e84_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5b5948c86c81580c8c779c29b10834a26
SHA1b6f8608bb836ac0b6caa2b9a3e4eba8b48249314
SHA256b318fb635c3008e7ea6eca1f529160d2856fd0a8acc534c17cf2f85b57427a34
SHA51255dc4e98058c4fc8cace53bba3f78c73938c9275e8d2c5fdb37b4d8cf46c5bfd2860c123fe5785c9b17eeb8933bc3edb0dc80b4c4156f1172351720bfd0909cf
-
Filesize
88KB
MD56dfc8eefd021a886ce5f2a891b8ef8b0
SHA10c85d9792c3f2336e75f8caf4ce7f15959504a13
SHA256138b32ea9f88041e29917f44c2d5932e2d22e4da040d35df977663153fbb83e5
SHA51241e63c4068f03cce4f2e12c2b07b2e0bdfafc9a24ce993f5d3a3b91b1daa03ec1eb554542b5fb243df2bce8e9cbe41411fce0b5ec87a0edaad3b7c9d682084cf
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB