Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/02/2024, 09:43
General
-
Target
2024-02-01_fad4faeeb5367238c2e60b8a7ea3b923_cryptolocker.exe
-
Size
45KB
-
MD5
fad4faeeb5367238c2e60b8a7ea3b923
-
SHA1
1a312dccaa42f71b996edc0c0f8c23a97ee2c3ca
-
SHA256
486399222a9aab5fa9c54c70018c438400eabf959d34dfe7cb73c91fe084b836
-
SHA512
67f2c0ec8213f4f3f1ad20d9c6c4748b4c589866d79101bcb241db06e549103c5dbc92e20c623bdb90429230a691729e13ed26286b51bff33a110eff1b5672d8
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoPW:qmbhXDmjr5MOtEvwDpj5cDtKkQZQhW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_fad4faeeb5367238c2e60b8a7ea3b923_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_fad4faeeb5367238c2e60b8a7ea3b923_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD53d746cfb4b50b937456eb45504b2df14
SHA1c4bb09d193b326618de479e4f48160422815a310
SHA2568cc7fa91d8e824d45bf46ef3c154e417b4be3ac5ac11c44dc274df517c079f7d
SHA51238e075372e862b5e1d99ffed104cc62720b001ba5b1b3943ac585670088d6d75af6c45dbac83fd245292ed58db1cdd30dcc9c4c1c03d64a5c025f142d3d30e40
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB