Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/02/2024, 02:48
General
-
Target
2024-02-22_ebd2bf388a96c78dfe879b04dcf5f193_cryptolocker.exe
-
Size
58KB
-
MD5
ebd2bf388a96c78dfe879b04dcf5f193
-
SHA1
a12c15af884a825dea4eb20e722c892aa5d13686
-
SHA256
248d9a982827a21fa839a9f20bbf12455dd0d99ac70feccb8cca4f8275c801e5
-
SHA512
d282a1be710eff7a813f1eb8e9870d61450048782dc76eab771cf58a430c5c2f175ac2a2b00c8ac8e931e985e96741769840d5e3bf9984570c0805d80d0d5c9a
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb614Q:BbdDmjr+OtEvwDpjM7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_ebd2bf388a96c78dfe879b04dcf5f193_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_ebd2bf388a96c78dfe879b04dcf5f193_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD58f3f3664caf816085077ac699553d512
SHA166b664b23b52d5cf6f4738eee3f76b95d8856a2e
SHA256e6c8061ab65c7a6d2d3c73fa87e85d61ebad2bf88ba30868470126c0ec0dcd15
SHA512c078f799e8168f97856b3a25992e73e7591e2615713d9434507049164bbad2352edaf8a002e041e5fd83c8a31255d2140081c4824dc05d3625726d22cd25944c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB