Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 10:13
General
-
Target
2024-03-15_f315900bce04686d97d939bd778d575f_cryptolocker.exe
-
Size
63KB
-
MD5
f315900bce04686d97d939bd778d575f
-
SHA1
80e0ec6428723833d794bcd5ba9b5e0e8b3e4dc3
-
SHA256
b4d8d84697baded906099125bbb32c27e5a66ac22fee471d3e1a1ecffa5fa9bd
-
SHA512
dc13a75b72d05ca978e335991add371c77f8359cc3292bdeb54f028a6202650888fb3636b873d5f12cce5e84240aa744a5f3957bad4652da3e7fab17758115e2
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UAXW:1nK6a+qdOOtEvwDpjW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_f315900bce04686d97d939bd778d575f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_f315900bce04686d97d939bd778d575f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55405535c57bf25117215052790005460
SHA138dc5d0ee9df6445052fd8ab75a5fbfda9772001
SHA256cfee838cbebbdd6847e214e4f56301f762e4abf31fb7662a8b16e7cbefc5f18d
SHA512cec4b187169bf8241e96950344ebda11581d70eb583e5bf8baf1cd468abb8813e2dc044ad6fc774e0c5081356edfaf13546aedcb18b191fce8fad83c50b88262
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB