Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-02-2024 03:47
General
-
Target
2024-02-29_ca8cc8615c6b62ededcb24ee1b25e262_cryptolocker.exe
-
Size
78KB
-
MD5
ca8cc8615c6b62ededcb24ee1b25e262
-
SHA1
775bf524f9bc75f35105520a12c9ad8cb1b4634b
-
SHA256
0d2cee9667c730f482bb79a2cda45d0e349608e27528338d98652143cd8a8dd3
-
SHA512
9745cd2e726c81a2839a6bf1279d530b1b2808fa55f11247ab74ddfc4ca6d02036c872e77492b06953629a3862b0d4f244be39dd842bfc4edd9474ceda7eed09
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOA+YSP7e:T6a+rdOOtEvwDpjNg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_ca8cc8615c6b62ededcb24ee1b25e262_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_ca8cc8615c6b62ededcb24ee1b25e262_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD53ef1311ab046f17d002ae345fd8bb66d
SHA1a12ecdd30ef9cf70f900b617ecee65f0f3ddcbf5
SHA256da79e796446b026f43f332c26199138e2cac0eb990ea65ec7d4b31f0d39dafd9
SHA512562820e80eb1e3f9b316719d26cd58dec62497fa1d7debcc62b65491e0d13dd7f197f8ac08c41a4e097602c23558e3e730e329412aac36477ffd1e7dd241df0b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB