Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 01:39
General
-
Target
2024-03-12_63e68e9d20510d607353b51068e5eee8_cryptolocker.exe
-
Size
86KB
-
MD5
63e68e9d20510d607353b51068e5eee8
-
SHA1
74555bda4e9b9d9d9c4e2cfdf890ef9ef2bd87c8
-
SHA256
9f069912df31fe522544cd7355f4fabe2a4ba9420082bd896b638924ce220c58
-
SHA512
4fd255aea5bb686252fed49ed793474dac67d0fcc71bfdc47a464bc202617ca7c9cf642e543619ed9f6d40ed35ee538406b71f47cb86364c5789d394415b5c8d
-
SSDEEP
768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIgjR:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_63e68e9d20510d607353b51068e5eee8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_63e68e9d20510d607353b51068e5eee8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5ee34f2ca90a7cfc8745775f5b270e254
SHA1febfb562b6017449770b129db212732d7ec98779
SHA256edc3b9bc6426453c2fd6bdb8c4d705ad33203f40eb0c572080fc0f0a1895039b
SHA5123b732e10988046399df0750eea42ad6660deea5cbfd434aa4f76c424f70934b926184f76fa7c8f18e1c2e545039fe6f5124a20fe9bfd3a8cbd02223e49bacf02
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB