Analysis
-
max time kernel
162s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-02-2024 04:47
General
-
Target
2024-02-23_f2c0f87a1dd3f5de9e578b3c1d19c8c1_cryptolocker.exe
-
Size
98KB
-
MD5
f2c0f87a1dd3f5de9e578b3c1d19c8c1
-
SHA1
818d49bd89b2ef1e2052f3d366e4acb444b03747
-
SHA256
aadf2e27bdc69f66741ad71f8b1fe8f864a842077dc42b671e234e8dbb289d88
-
SHA512
3ba73559523b676d1e4f674e2db76bd1a1cb5db5ffc07d45dbb2dc89f9406d6fc7592a2158974bd65a1f054906806a946144f2ac345ed3070d488ee541d576e2
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviPGF26:AnBdOOtEvwDpj6zP6
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_f2c0f87a1dd3f5de9e578b3c1d19c8c1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_f2c0f87a1dd3f5de9e578b3c1d19c8c1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5aed602a9de20a55621d27836523b8e01
SHA1dd4bb58ff00bfede0cad4c8daf640f7b4aa10b29
SHA2567e940e9a7d7f0c252a992d36306a91b95eaa1d9fdfd9964f829bbe5a34ea3c3d
SHA512eec41d7f8ee97906c7546f3bdc387e835ba970b7f4a70303646e9d0f4a478b014ed92f8d8599c44556418c94a0eb2b2ec1a4f308bcb5c3cab5c5273e86b146e2
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB