Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/02/2024, 15:32
General
-
Target
2024-02-01_aef2724d8f52bc3d3655730e775c982d_cryptolocker.exe
-
Size
28KB
-
MD5
aef2724d8f52bc3d3655730e775c982d
-
SHA1
a39706570d07cdaae7cf8aa7c2679dd811c2b9be
-
SHA256
0276f85806f2e9dc7e5560f46450b51d6c0f08a217a28272e94814b465f24b31
-
SHA512
a1412bbcb52caae0a05ba43cd61630f2b808bb22eef6fdfbdb7211d02daaf6de6d081dce61049ffad2b2037516efeba8f84b0aec8cfab2ab1b3b9d1d768eb4b0
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+/:q0zizzOSxMOtEvwDpj/arZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_aef2724d8f52bc3d3655730e775c982d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_aef2724d8f52bc3d3655730e775c982d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5914d1f5ab49682499872be5f0e1c3833
SHA10a43448aa7a40ebf05eb8dc2d5d9064b416c35f9
SHA256db38c95885cccfae6075cf051fa85669994d5d458176655784e539007e77dad4
SHA51257bf819f67866d2d864564e90e0c32098ebd50b3efd908a1851b4d9d54e647ec82e0b651324bf957440946a26a51fc5a14a63ce545a2d88b1eb096e43f6df913
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB