Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22-02-2024 20:48
General
-
Target
2024-02-22_fcff8f5e6ef206a81095eba10498d7a7_cryptolocker.exe
-
Size
87KB
-
MD5
fcff8f5e6ef206a81095eba10498d7a7
-
SHA1
690d48d6f839a3a827ece314571eddb21b363694
-
SHA256
be41fdafc5bc1f8267ff0a596fca546fd9112b27c1d72a30323c9b60b3aad57c
-
SHA512
15486fe1165789e2b522efe57f423f0a0e1cf0414d8b732e72294ac750e14f02ced68e5bb35bd65d6529af9792c6ef6011e96251fd522b52e3ad92081740ba3b
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgS9:AnBdOOtEvwDpj6zo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_fcff8f5e6ef206a81095eba10498d7a7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_fcff8f5e6ef206a81095eba10498d7a7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD510fc0749ad81ce0cc70f14f245dad0db
SHA1d640a86c21b58e431f85ceed7759cf87bb875cb4
SHA256bb544a4cd71f5ec1ed3ecf3702437287717bec50d8d7fc8d4fe8726d3f27be0f
SHA5123bec36d32091f94d985986991cce92baa05a3ccd83b1454bc2ebadf6e8c44ad611ee0cb935c5235b03610824ed42f5af5cdd1c9e806977454629e34b06d25fdc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB