Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-02-2024 01:57
General
-
Target
2024-02-29_eca5a409a32cafed02b31a86dfcfcb28_cryptolocker.exe
-
Size
108KB
-
MD5
eca5a409a32cafed02b31a86dfcfcb28
-
SHA1
6efc91b5e76d82c2b23a3541f515e6d4c623077f
-
SHA256
76079ed8cd2d845810cdbd37d0db94c54fd876ad35d32409449ca281c174712a
-
SHA512
6d5421c4c9e853b9d649784623e203be5ac3c4cd5edf2f3ad2566600d79d371ee9564d491af3359363074573582de882c38336a1c929e5b62c7a8df97d4951bf
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksgEneo:1nK6a+qdOOtEvwDpjD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_eca5a409a32cafed02b31a86dfcfcb28_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_eca5a409a32cafed02b31a86dfcfcb28_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD51742905f22f91f34cde14f497d3e7978
SHA1f86e9b0fe758963e578c0028ff5677fdc6bb0896
SHA2568624ff6d7475152890f9a51a30387f598ca6962eb671c8caee9cefe3f31e5b50
SHA5124068440e6817d0f192a382ffae4d44a465a527408f06ea324d659a5a608420a6badf4bbb80fb89e414fb4c332d0644a9bf47d18348f136459e850097b28e381d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB