Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18/03/2024, 18:38
General
-
Target
2024-03-18_8c962f26ad5b6e4e4f1daac770b5f794_cryptolocker.exe
-
Size
88KB
-
MD5
8c962f26ad5b6e4e4f1daac770b5f794
-
SHA1
30bbc9d2d9da18f1d095527d44827fd27ca7e40e
-
SHA256
a77f057f37d9a7df6820381a640ab4908adb4eaa8f55b084947d8c16e3d3758a
-
SHA512
3679708f2363e510c9dfa854f2e87a50c04ff4c5cecb9b411c169b37224ab7443db03d261ea682c93bb41a4e0686d7ff35c4f8af5475cd32e9f8d0afb4902b4c
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgdVT+:AnBdOOtEvwDpj6zzC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_8c962f26ad5b6e4e4f1daac770b5f794_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_8c962f26ad5b6e4e4f1daac770b5f794_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5e1f447ff8a369b24a04e7d9ed22c42a0
SHA176c6455361e8d742a260ed956693b7391275b374
SHA256054627dc26d905184cc1b3093bbc50eb7beb64d6ceca1e1975d776c47f415033
SHA512b62607b42edd138f297ff071e7665f12b9e1f0f21ff501e67e7ba934aea939f20227320156b9bea375d993b1de2889532fecc043fa832c4309c36497fd7df04f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB