Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/02/2024, 12:52
General
-
Target
2024-02-28_9863ac1b8072dc9c76babc18ccf80c02_cryptolocker.exe
-
Size
107KB
-
MD5
9863ac1b8072dc9c76babc18ccf80c02
-
SHA1
c391bf420b9222b921d0627bd3e0a1369952e638
-
SHA256
2b6bfb450d95989450c82edc6adb52df9ce708435a230c74c0edfd191f083a27
-
SHA512
5cda53d34017bb1a8c4e73a1a64bc6475e7b7855ec0fc10eeb37b995591c8151dddccae405c1a438331bf7d24ef35bac90ed6e26a6326adbfe787eebaf9eef7c
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwMgc:z6a+CdOOtEvwDpjczI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_9863ac1b8072dc9c76babc18ccf80c02_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_9863ac1b8072dc9c76babc18ccf80c02_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5fb858821bec29de4d1742adca8ea24df
SHA11d0f34675f74ba5724cc23538eb02c394f8a30c4
SHA2567a512983c50bc9f475eeb9cc4b4bf3f53b9a14e2915cfaab4ec8d2e387df7b29
SHA512fc7d95068946b70f6644b29b20acfd26edb64ba877e5b07b6b2f090401ec32dddd403137db7685ee6ee47cd8a0259f5b76e5a210c182c9a16d59b50114e34702
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB