Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
25/02/2024, 05:48
General
-
Target
2024-02-25_8d21ab341a8719d07656c320d16d74d8_cryptolocker.exe
-
Size
63KB
-
MD5
8d21ab341a8719d07656c320d16d74d8
-
SHA1
0b30efc3d706e41de916780402e674bae071a63c
-
SHA256
94a1f5d36b41e2ce1e072c059146a99b4b76d89eb9970fe28df7085b6fa84f78
-
SHA512
c3b79a2f1fa0708bd84c92c998509bb4fa1d259ff0594b93060bbd31224367d0380df6514954f0f284ad0a2ca07bcf198d5ef39bccf27b20d66816728aa8fbef
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAof:1nK6a+qdOOtEvwDpjB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_8d21ab341a8719d07656c320d16d74d8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_8d21ab341a8719d07656c320d16d74d8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD53806d66957abf8788851ac101c00c59c
SHA1f25047fba810636d2a5bb815e47511af16f9323f
SHA256addd6252083251b8318b34d3fa568c44223481c3d274663518468c2b2d4cab78
SHA512504c80c3a4c935b4d7544b965adbdfbdafae1375f9e928034a42b9c05f189e21f93a6594364fe3e60818b98f2bf194dccd36a02acea0599a8cb31068f5e68f04
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB