Analysis
-
max time kernel
149s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/03/2024, 10:59
General
-
Target
2024-03-08_d5e2748b9bbd5b47c62d868eb7f10b88_cryptolocker.exe
-
Size
63KB
-
MD5
d5e2748b9bbd5b47c62d868eb7f10b88
-
SHA1
c5ba24151f67ed2769409ba66ab4d41914c12a4c
-
SHA256
fbce94229e040ec6b4c8f9a04235db7cc94bbf32c68d249db1d25fbfe2dad1f4
-
SHA512
b3d1fa4703e03a3cc4b486a4fabe6f4d06e13dedc53ccde03216bf39da1284e1d3d135c615c03ab7a7a8743ee37c1320f7d9bd5f4adc4a7826d6ef6bf29b6168
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAo7nM:1nK6a+qdOOtEvwDpjK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_d5e2748b9bbd5b47c62d868eb7f10b88_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_d5e2748b9bbd5b47c62d868eb7f10b88_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5b3363f40c01e3394b57b2162bf405589
SHA1e02092b32cab88dd381ba232961962b86744912f
SHA25627fbbef4d9cb8c8607cadc77b792d40dbbf3112969f9e661f201b747377db2cb
SHA512d5fe512b0983739c93d86ee7113193a85edf008b5bfb376ac7bb03c32a8487afa3a47219d308ec8a63f0c03d317d5a2cbe1cae0db5a4c4a7471979c5dfb3e6c9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB