Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 08:46
General
-
Target
2024-03-14_c0d8c15ed3c52e94cbb66869d1551ec7_cryptolocker.exe
-
Size
106KB
-
MD5
c0d8c15ed3c52e94cbb66869d1551ec7
-
SHA1
edef9e8af062e9c5a720e863f4e63bd0503ca14e
-
SHA256
2a2f24cdee8939ef200cffcc19d8dc2dc161dc809161b1aad9aa18daa0c9b108
-
SHA512
eb18928937c0531128d94d081e591d77c2435ac8b669db2afc04f44e8c807f0c0e9c637c3002e15aab5b3379fa55263430cfb7c5592a15958d8711250ad6e375
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksurTr:1nK6a+qdOOtEvwDpji
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_c0d8c15ed3c52e94cbb66869d1551ec7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_c0d8c15ed3c52e94cbb66869d1551ec7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5854d533d2b353af5e0e8f0f2ea4e5d0a
SHA154fe87c10a86492a98fb89a74339688ed8e0ddc9
SHA2569f41318f4d85a11486aa5dcfb9b95029b3eff4cabca5d1d27f979207b3a1a8dc
SHA5121b9f678ede34443d75f6a6450dedcb9ff3e96a74622188d3c1ae2990e832e5771b25080b4de31d314cf9a29091a68bc2bbb41a1addd3bd56248cf61ca5f8d35f
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB