Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23/02/2024, 23:42
General
-
Target
2024-02-23_da8e48fc11b71a852deb5f7570204a20_cryptolocker.exe
-
Size
67KB
-
MD5
da8e48fc11b71a852deb5f7570204a20
-
SHA1
99dfbef0363fa2432cdee0914d0f64540b335d91
-
SHA256
e7d11402b39e778c4e61a9fc26e4f17b68717f7e9aa51bf0970a4405b8ec7f8c
-
SHA512
d68adacd9d1536116dfe9c7e47804be6c54092af715f43e50f6e6743b52f965b7acdd231f6887ced28a92b736d7d52cbd8a6ef10403b49612bd8e0c20469f5da
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBa:z6a+CdOOtEvwDpjQ8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_da8e48fc11b71a852deb5f7570204a20_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_da8e48fc11b71a852deb5f7570204a20_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5843c07035f6ce6a152ab1e7b5ecbc296
SHA1201c3f6c822783762f71b0e30bb85b325ceae763
SHA2568b6864203181b952ef7c10bc11d9a31c1d9cc78c141036b8e844f29d5d3cc0fc
SHA512ce58c84c4945c5f87d9b0f2812659b7cf524a459ff27311098cb9d348b3fb62173a6a3291fa26785e7f6570661af13d57f8a2e8911c3134993228446637c1ab6
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB