Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/03/2024, 06:38
General
-
Target
2024-03-08_b26e2560d028e18279d012f44c9b44c8_cryptolocker.exe
-
Size
127KB
-
MD5
b26e2560d028e18279d012f44c9b44c8
-
SHA1
5fac947b2d2fc881de16f6d44000be8ea23cc26d
-
SHA256
5885f20a33b2d70fcacb12f21b188f1e833500fafe590e3e16d1ec83bfa1f14f
-
SHA512
bcb2403206ca0cf8def30f5ec01d24cf9a0ec1a64d03ef2de97dccf90eac27aa034706594c3c1f4bf0e9cfe9d812861bae868e6edaf10d96d7e1e0261dc7ad4f
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eIO:AnBdOOtEvwDpj6z/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_b26e2560d028e18279d012f44c9b44c8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_b26e2560d028e18279d012f44c9b44c8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5d47c9afde223f06ee6fa80cba966b494
SHA12f2f8ab055f7825a2d404a931fa0d217e18260f5
SHA25637bb8c64408b2a4d440209425a9ae9e013947150a8419af3ea8185c03e0319db
SHA5128dc2df119026603a49765981d6bbc98bd49012a0cf5b3856b3d6aedb04dddf48a4309c74b92fb1d8c087e2668184781ef27b6c75627f120f2e38fb676ef8a0c6
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB