Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-02-2024 05:02
General
-
Target
2024-02-28_6fa0f7fa5106bd2e282e0ac920dc9498_cryptolocker.exe
-
Size
95KB
-
MD5
6fa0f7fa5106bd2e282e0ac920dc9498
-
SHA1
efd2fcc16d2e248dc9e3bd4e032f92238efa0215
-
SHA256
68c22c2d86d85e73ec69a97180c1d1c0b49fb6d59fa26e9c2fea7a7b28794300
-
SHA512
67c7fc496f5e3259ed19a1688811ba6bf084d94e9812b599018830af9db63453c96856a69f88bdf637b135de3251e040ed63a4cb413800d8b312f66a8da784e6
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01Oy:AnBdOOtEvwDpj6zJ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_6fa0f7fa5106bd2e282e0ac920dc9498_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_6fa0f7fa5106bd2e282e0ac920dc9498_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5d1686c45fc9f35e814a60d83b7bd1e26
SHA1c1acaed90b374b77584495acf39efdc36122b8a7
SHA256fc65eaa5f29cc616574bfe834a41cdb8d3987b62b05571049420bf42eaca95fd
SHA512c7ceabdd0c193634f0baf28a6bbcb296fd440a8ea0ced47504ff9eb4b6e298d96cdd7d3f93f8aea9a20d6250df718128181256dbc54d8a9b403554ebac2db9af
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB