Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/02/2024, 02:27
General
-
Target
2024-02-25_245c601b835a475436f37fe3ad2a7658_cryptolocker.exe
-
Size
127KB
-
MD5
245c601b835a475436f37fe3ad2a7658
-
SHA1
bee01be3e44e42da4534a16d1744e2eb8d453a2b
-
SHA256
64ebacc4687da8995df2438aff31db8ca915db94d7da9400c0607f4768685664
-
SHA512
2541a7e02cd959a31c62407f4c0beac569a43120aea9410c53339eff57cda870e905e8e0aefce79120fa7b0ce3a0cb16aaac066a1982ed229a629a61fd9ea70a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1e0fx:AnBdOOtEvwDpj6z2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_245c601b835a475436f37fe3ad2a7658_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_245c601b835a475436f37fe3ad2a7658_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5df95a2126492d524feb9acf01b49c5f5
SHA1d7a43596fee57a18ecd0344a123444874319967b
SHA25640509040fcb84bbda192ed2a9eee222e57724dcdf0bace2accb9f4bf11aca0cc
SHA512137d46fad67d8fe28a7cbf370e1d0d8981eefc7f9562bacb3e2e3d26599c27fa3230711bd3aea87e63d2d0a5f5483e310678c958497b87647499812efc61dbeb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB