Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
28-02-2024 10:31
General
-
Target
2024-02-28_281f6dcc6a80c5d35713208b8f87e61e_cryptolocker.exe
-
Size
72KB
-
MD5
281f6dcc6a80c5d35713208b8f87e61e
-
SHA1
439f0a6a3bffc8ad3e9b470e2699f7b50d42903b
-
SHA256
7bd5ee7546eb876f32aeb98b69afdf75e01644af9ba17b0fb63ecc3f650a5306
-
SHA512
8a5d252426f3db1216ea270b85f021da708eb18cfbd546cb1a72e5d8869fc692eba43c35d9d4372ac0cc3a1ec19b062e68adf425aa043cf99b55d558f94035ff
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsale0:1nK6a+qdOOtEvwDpjY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_281f6dcc6a80c5d35713208b8f87e61e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_281f6dcc6a80c5d35713208b8f87e61e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5d62b0ec9b261055a08ce18b20e5ab5f6
SHA1b5e957cc3615472a487f9cc413f5989c17e96b4a
SHA256f0e618ca049b9751b5fdca62905b623482c8096ac7e8927aa0d1fbfe304f7890
SHA512460d4357eadaec3427aa784601edf0b69ac8d2034067bb0f77fb7d8a464934d5e0bad430b27bca9a486c8b5c2b3e82ba0a3713249324670e70a0185b61a88fc7
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB