Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/02/2024, 17:26
General
-
Target
2024-02-12_257a522d0d757aff74acda8758bac085_cryptolocker.exe
-
Size
46KB
-
MD5
257a522d0d757aff74acda8758bac085
-
SHA1
38296c02af18b29d454bf5da561c203f9aa2f253
-
SHA256
9b13ca47e6901009688bf2d791c81fbc1c8a53a6bab831ad9d2e6c4935e10d5a
-
SHA512
3237cf0c2a7824a6e119eb9a80aafac3ae8a0e8fbcc7c928d4c947d304a526e9fefa063e06ab6ce053fda096c5801e0cdf5edf51dcf781e5b7720c33d78cf070
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mofa:qmbhXDmjr5MOtEvwDpj5cDtKkQZQha
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_257a522d0d757aff74acda8758bac085_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_257a522d0d757aff74acda8758bac085_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD572a80d0f05c711f3f6359bca58551339
SHA1127ed8eb9d1c03c9aed454882b696f4e71c4574c
SHA2566d111cd4224dd11ea80187dd7d8b09d10dc331a6bf8821b100c8f7564b4e9926
SHA5128024b022c28decf081c8682221ab8cd804b4a1e51daa83d6aa42b6907d9da48073e9982fdac502f36d039c0e3037f3f33b417839328cb9c13b14d98e0f6cbe56
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB