Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 22:25
General
-
Target
2024-01-27_63bd241c1e8975730b522bca97516492_cryptolocker.exe
-
Size
45KB
-
MD5
63bd241c1e8975730b522bca97516492
-
SHA1
e2f4a33fa46657ae11d867032c3964d0c7d4e0a7
-
SHA256
47e12d5fbb2d60a8ab07a84bf8c4c7bd0b697a6c08b1cdb0bceb8252da6266c0
-
SHA512
2f1f8603411dad9012b2697b462560162088d2f8b93fbb3e2f5fc4d990234c4df38229ee53df404fc78a3b2e4b91e82794c07854b1b7c95518b163035c44d798
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoW:qmbhXDmjr5MOtEvwDpj5cDtKkQZQU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_63bd241c1e8975730b522bca97516492_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_63bd241c1e8975730b522bca97516492_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD511ecc0c42a917f6a4ab63ba0ece871ab
SHA1153d52bd084572c2e393a45c166263d86011a801
SHA256a776ea41fbe7c65b832b8d8cc7579a9325fabf722cf4d98b9835f164357da37a
SHA512afb90fc630b48e0c5a1d519540d9739d14774bab34945d51e5e256980520465039034221027f1c409e21d447598e7975b052133507d3ab59fb7b6fe6d5c0b3cd
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB