Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-03-2024 15:41
General
-
Target
2024-03-14_821d964c8858560f13f6efb653543f98_cryptolocker.exe
-
Size
63KB
-
MD5
821d964c8858560f13f6efb653543f98
-
SHA1
394b180916231850bfc2e86a28830033a2570d51
-
SHA256
7266defaddc8c225899cf81cdfaf4c5b39882d120e3c4b10a285ff12038687cc
-
SHA512
7e14847dba1604d94fe962bc9da9798e5d39f2519730ad31b9f5b49853124c09329bec13f62c5ec0f52283d6aeba247f01445cf575be990063527d2f59a2a5fb
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAo7cz:1nK6a+qdOOtEvwDpjY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_821d964c8858560f13f6efb653543f98_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_821d964c8858560f13f6efb653543f98_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ffbccb965ac69210d73017a41201ecbe
SHA1f4066c77172472672f26251c282bb2cb8eff57e9
SHA256e852a153823fc53304f1735b921bde1aea583c44a2a9b50ec4f8625d6d0836ee
SHA512d6e6f68e8da3c709f25c881b9d6edd172d5c009c42b63e4dfd47317a991d5fdbe4026225fbc9dfc00df601feb3217758d2e1e2484a76cae08cedbff6c4420fbf
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB