Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
07-03-2024 04:24
General
-
Target
2024-03-07_2d7355a46ef24e6c7e718512b94eb74a_cryptolocker.exe
-
Size
102KB
-
MD5
2d7355a46ef24e6c7e718512b94eb74a
-
SHA1
92b99c4a084fea3cb75d463659d0ec9d2863a409
-
SHA256
249e806a1952b330ec3dbeafb6555519c2b3abe00ceb7b65dfb3e061ed55f2d1
-
SHA512
a220f6c2ab7da37fda4cdd3b044437d56ceec8120a2c1c0baad7924dd4f9eb40bb4ffa4413acf0c8a6750bfe60b40830ee64741e23d4095ab927cdb46d2b069a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviy6W:AnBdOOtEvwDpj6zC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-07_2d7355a46ef24e6c7e718512b94eb74a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-07_2d7355a46ef24e6c7e718512b94eb74a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD58b073377d2bb2c65f0d1705e3f8f916a
SHA15e943946c434cf4a5df84b89db6bad248f75a089
SHA256479ce328524023a8a9c758eeefc86ec2c00a9a4543e00a9a0d3f9ce8ab8983e1
SHA5122afeff235ab27332b26d343cf0005a20ee385f99443ab9cbdbf3c10a4f8385a98b2230504101eaaead099d262a867dfc0c50f4428c3b590e10696d2f82206c94
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB