Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 23:34
General
-
Target
2024-03-15_627bfeca062bb5691fb9566f1a928eec_cryptolocker.exe
-
Size
72KB
-
MD5
627bfeca062bb5691fb9566f1a928eec
-
SHA1
dac277aa0b3801ec015dd1335d4069ea49b5a7e6
-
SHA256
4b1eba3c00dcf46b701789c31d56641a2fce8285316f43cbebaceb6fb83bdb53
-
SHA512
4b393283d47edd1e38b760075bcf849fd7feecb2148fa2fd3be52be86734256e0721f577fccd758d41bf17999407897931b8b618ceb13bb1cb1b721af4699237
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFQ:1nK6a+qdOOtEvwDpjS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_627bfeca062bb5691fb9566f1a928eec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_627bfeca062bb5691fb9566f1a928eec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD57b1033ef6b10d33b6ab14a233ac484ab
SHA15b580f96b722a5da23a960c73b62138f3ff7712e
SHA256890efff22700c9bbcb724c16a421be6dbb6dc42a212d80ebea9969886d63069d
SHA512382c7fb5396bfa1376961cb3dcc204ed6f0987e33872ce1b5ad1eb2ef23e1d1d648ad84261b449e7e7db4e8e47419253b7d3a00e93101297123f378c2f3e593b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB