Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29-01-2024 00:24
General
-
Target
2024-01-29_26f9bd105c03811d0a0d84c67ff85655_cryptolocker.exe
-
Size
45KB
-
MD5
26f9bd105c03811d0a0d84c67ff85655
-
SHA1
49bcb70b0944b5e2ad3769a39d3ec26a7151bd8e
-
SHA256
fd04409232f0eccafa3288f400eda23c8e8d4404b7e6fa3b7d1fa931c66639f0
-
SHA512
03b5044af4e3c9b461c1528efbf293ad1307fd1d18ffd0cc4d612508fa4dadd87beedbb96f4fbd57dcef10174cff610e0f69003dbd93ce128c825afadada7252
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mo4qF:qmbhXDmjr5MOtEvwDpj5cDtKkQZQX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_26f9bd105c03811d0a0d84c67ff85655_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_26f9bd105c03811d0a0d84c67ff85655_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5fa1f8877c892b26301113ac419c392bb
SHA1f075be59aa0c9f63295c938ecb08b8344a29ec7a
SHA256383d7fae7ec1a10a9a5a04c28080b04106a6e4a1367c4bdf3a8598ddb8d38a48
SHA512a9f018e251e4df5196e169d9df7b209e550fb2af115b8736b3bfc56a323cf5408b173a259b9082bf9e5a1cb026074812136a7b47deb203f9151c4f7f9adc2e86
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB