Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
29-01-2024 05:42
General
-
Target
2024-01-29_ad9ae251738e1c85e9311676ea835682_cryptolocker.exe
-
Size
56KB
-
MD5
ad9ae251738e1c85e9311676ea835682
-
SHA1
cc181a00100abaedc6284cd121e5d3853b2f38c4
-
SHA256
65b3219b810189b8264c8cc81896aa2ac0240c4f8a6da2c39621d01e7aadef4b
-
SHA512
04b07bc76f1231093f67007339781df1afbebb957119526e4d9178bbe7bbfbde22e6cd16778d2bac7ac4b60fc4862490675997bd9757e7d339da17f0c7619557
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61s:BbdDmjr+OtEvwDpjMG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_ad9ae251738e1c85e9311676ea835682_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_ad9ae251738e1c85e9311676ea835682_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5da81840adeef40b26a81422d8c072b7d
SHA179bcd31e787cf131f6941858cc930f026e86bc5d
SHA2560770d6a4feba2fd73ec412f24f2a3a0842f65c2c50c6876fb923efef0d457588
SHA512e2a7fe57cba7a1fec119dc8e3adc355721fdecf1f6eed00ba3e1d9714d3243305f2b70f98e5c468a21330b88625d5825a9126a404244231538690a2dc03b903d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB