Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-03-2024 00:39
General
-
Target
2024-03-13_b1654bdf0a30a499f70a8105b9e26ff4_cryptolocker.exe
-
Size
71KB
-
MD5
b1654bdf0a30a499f70a8105b9e26ff4
-
SHA1
7605f4a5758c4385d2e67b28455b769996a9ce6e
-
SHA256
f073d3af6616b9696c0c1d604c602cd5df67594124444fa48b6f9a486baaea8a
-
SHA512
e99174486405bdbd06c44fd833ed90d86e076d8c565ca73a89d8097387ff290042b8435876c820c084989b412b062dfcb997f0d70a98bd410277c3f987feb458
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBW:z6a+CdOOtEvwDpjQI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_b1654bdf0a30a499f70a8105b9e26ff4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_b1654bdf0a30a499f70a8105b9e26ff4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD512720be545b8ecd150cc9342a5e8b009
SHA1c51f17d72ca357d82dfbbd656b3bf9906c4a1b7c
SHA256fa6caeb21a4bbc242f9becb960cdfaae905f5a3445adedb8e1cdd9bff5f98f5a
SHA512b7da173eaea9e93e35c5ebaf35a7a83417c05b3f30ef6b52497c6323b08bda102595bc9d6c62d15e855b8668528160dc2da54ed632734a31043413e2f05aed37
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB