Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 10:23
General
-
Target
2024-03-16_0c79175d37435b9e0cf1ee97785521d1_cryptolocker.exe
-
Size
71KB
-
MD5
0c79175d37435b9e0cf1ee97785521d1
-
SHA1
f0c96e7dca11a0a1bf6178d2f23f021600ac402e
-
SHA256
05b68ef797b3e18a0c1f9193b2923be82fc7c1cf3efa6d462b973464b69b530c
-
SHA512
7f249c9323795d703aec102def3a3dd6e618d71f7b26dd90ac2767cbc8f69f05c1caadfce266ff1a306e910d2279b8f6e138cf6ada765c58978da768896fc92e
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBA:z6a+CdOOtEvwDpjQe
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_0c79175d37435b9e0cf1ee97785521d1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_0c79175d37435b9e0cf1ee97785521d1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD599a6a32060bee8777a3efff812a5cb33
SHA1af8df042a9e3e7e32e196c66a82e38a995c013e1
SHA25670f4bcb47c173eb1193094f5355427c8fa26b9e241ecdb86ecc0e8110561127f
SHA51255c7f9926057029613c402bfc324b086fb0196f4b12202acd1efd9ee6a6f11ad40dcd4fdf5a9c12d8338ea399a184080ada2bd7302b029aaf963c7b82ec65334
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB