Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
05/03/2024, 08:26
General
-
Target
2024-03-05_25c7372cc450d3e0a3c10ace7c793c72_cryptolocker.exe
-
Size
47KB
-
MD5
25c7372cc450d3e0a3c10ace7c793c72
-
SHA1
f9b0b673bf508722c3ba3a636ca62b45af24e59e
-
SHA256
bd0e572dbaab2d37d17d4fcd2cfab9a91e98e1bfc41999dbf81cae524f8e7c4e
-
SHA512
a799bbf3179fdbbb03b8f9c723cab4bd795b974a8796f7f184498ad242f4a9968a5b082380aa841bb8f93a55ad2de41dad9d2f069920c0efaf30a5c790f738cb
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mof9:qmbhXDmjr5MOtEvwDpj5cDtKkQZQh9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_25c7372cc450d3e0a3c10ace7c793c72_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_25c7372cc450d3e0a3c10ace7c793c72_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5e755bdfd74f3ba3b62c285900a7eb0bb
SHA1c81a5d5ab246c973b73c32f3fc42c3a1235750d5
SHA25619ed70bfe865562e32b6b262ebc13ded99890ab799de3b37afa98085cef3119e
SHA5126b3adcdecac351410c5c069ebdba37e45d72f7d619a9ac73d4674624c0d68cef74a22a45aa2fe48efab8a5d6d40d2933015b9ba9b5e89bc1d89cb185d1171a8e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB