Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-02-2024 02:46
General
-
Target
2024-02-23_c86209e650de4fd5a3c38b7386d5ccff_cryptolocker.exe
-
Size
88KB
-
MD5
c86209e650de4fd5a3c38b7386d5ccff
-
SHA1
ef5a0169e066eed1c3e5aafb0c341bae9b445a7d
-
SHA256
2833b8d3b8eb040f00407b7bdd1edb15e43cd1c1b05586d7e5c476687a1b20e9
-
SHA512
97440c83eec73a939e4d9034d25b5e2bc80eeb9c14bf29eded75098274f8bddea9cdb7dea54e87bfa4d9d25f6f0195bdf0089ba78571c7d07dafdd56789c137a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg7dU8:AnBdOOtEvwDpj6zF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_c86209e650de4fd5a3c38b7386d5ccff_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_c86209e650de4fd5a3c38b7386d5ccff_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5bff1b088a72d54ebc69fd592dee86312
SHA12e4ff8256e5ce31e8779fecf2e1c62073367a4f7
SHA256ea0e0591c49777262f13b644a760945adf52e6d6c0d3d8c3c349c4f6bd05f45f
SHA5123aa8d6f098ec8209106b123081e3a3e72aaec0bd5f53938ac5817cc7a5749968c57ecbeb821d70806e05e03a1429b967b87ce59432150f7632a1d5f9c26e273f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB