Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
16/03/2024, 06:46
General
-
Target
2024-03-16_db51e15c7b1ea85c1d23eefadd2ec8ad_cryptolocker.exe
-
Size
86KB
-
MD5
db51e15c7b1ea85c1d23eefadd2ec8ad
-
SHA1
9c56d12a942487c46e5690a55d57989301a9ae4b
-
SHA256
0d2aa87b28191ba3c5fa73d57dc2e6fc5c3663c0e5917142926376cb456b9a7c
-
SHA512
580d1db4b5067884e695d8f10454aa68ee4e96e6aece6563c31f67402e8cd29c2bfd8b0b115482257a69608ff166b7a8109fdab4c7b995439587437dc2b9e72e
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgRx:AnBdOOtEvwDpj6zD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_db51e15c7b1ea85c1d23eefadd2ec8ad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_db51e15c7b1ea85c1d23eefadd2ec8ad_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD591d3b1de9e8733b7674c0c7d8a4ac50b
SHA13a94bd37175072f903ef4deb6b60e0d4d7db633b
SHA2563f6710bf04768500cebb7f6af20100a84f8a140fe2af35df3f7dc4dfca1219c9
SHA5127b5846b23d3202f7a1e29f0ffe463590930311e2b24295a8152ad4881beaf0c64e98f793c8b7494becf174fffc5b46a1073d891991550061145716be72554efd
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB