Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/02/2024, 12:04
General
-
Target
2024-02-28_e094e925bd7da8e4703fabf5ea7e9fcf_cryptolocker.exe
-
Size
126KB
-
MD5
e094e925bd7da8e4703fabf5ea7e9fcf
-
SHA1
36119eabdb0b84f72814d587e2376636a2b986f3
-
SHA256
095184643556542f169cf7a1cc2a37fb2169104e1342eb39ce262c622d00df32
-
SHA512
00137e8526027f8d2edc5f55f75db0cea3b916c8b03a2b2da04bd4a1efaaa07ea8db9c4d00ffa1fbd3be335bb6047019a3f91787f9109a87a12ea07806deface
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1e0G:AnBdOOtEvwDpj6z5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_e094e925bd7da8e4703fabf5ea7e9fcf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_e094e925bd7da8e4703fabf5ea7e9fcf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5c7c2eacd9c5471c3e9077718f79992c5
SHA1cd37a204cd6cae7d0c88d312dc756cd0fcd42c7b
SHA2568049c15655fd845dd4b06765310ba2aa4e48a343a51fd41e53ae9ed042a45c43
SHA51274dd850199e43653695ff3c6960dbe78e202d4a04d909b21fafab9727fdf97f37e877b97eeaa9e541ee57cae91898ae9af130ee3311d261f12ddafe4d1bff847
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB