Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/01/2024, 17:30
General
-
Target
2024-01-25_65c2ed41227c679de88ccfb2b12ac7b7_cryptolocker.exe
-
Size
56KB
-
MD5
65c2ed41227c679de88ccfb2b12ac7b7
-
SHA1
21efdb8ecd469881d9ee1ef1e2bbb0fb662c6378
-
SHA256
9fadb5e86b1a4ef3902c4617c4aa8d2c48b720f1e65b2278a95485226de7c532
-
SHA512
f796787209a27948678ba45053ebaaa15df7201a6a5fbee9e91a8d305354082383ed87e776be940b53b265d3a550009b06014b408b1ab51f64c747e5e9d45896
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61PTB:BbdDmjr+OtEvwDpjMT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_65c2ed41227c679de88ccfb2b12ac7b7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_65c2ed41227c679de88ccfb2b12ac7b7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5bb45e1201d21351c7af45e0afe6e0ec0
SHA1c4fb0fb6cb81237f30fa27540bb8d7e0319209a7
SHA2560b61be1ee2303c13064d0a43e458f7e43f822310ce835aed088098c7e37e7b18
SHA51221134ac343c7961d004f5dac5689dd3e51a748741cfccdab7be88ebb3247efb274360b5a740864634e722c2be258dcf21a14193478223185db857ac7adee62a5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB