Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-03-2024 21:27
General
-
Target
2024-03-13_15895e1e8e6abcd1533cb3a20a63c976_cryptolocker.exe
-
Size
44KB
-
MD5
15895e1e8e6abcd1533cb3a20a63c976
-
SHA1
fbc2814c2e0da63937923902f681fecc5b1a3779
-
SHA256
dce4ec9b61820fb6989ab95fa3a4e8d401559edfc8390bacba9b431560fdfdfd
-
SHA512
2b8e61425174da7abdb01a5b1f43274f6dbd295602c33699e191b4e6e026f278146355f7b5cd24000640c0936029021398a9934ea9eaf52c0451d3aa672f6dd6
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05Wpc:qmbhXDmjr5MOtEvwDpj5cDtKkQZQP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_15895e1e8e6abcd1533cb3a20a63c976_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_15895e1e8e6abcd1533cb3a20a63c976_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD531eee9ec926f704e583a3181bd3684c5
SHA1a310146446fbfaa369d926dabd6b9777744c6ac0
SHA2567e1715de7c2e7cdc29a92e3afb320b15b90788d850601be072dec574cdddf0db
SHA512c05494967311d1eb14f234f6c97cdea31289875cd528f1a7f9b9451b4a989f2c0a15811dba75633dc28bbc32d78cbf3e6bddd106dd3bf77b2a5f094a87ef7923
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB