Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 22:40
General
-
Target
2024-03-13_f96e4dab45951bc3e07567fefc7c5f26_cryptolocker.exe
-
Size
62KB
-
MD5
f96e4dab45951bc3e07567fefc7c5f26
-
SHA1
8ca75da97c13f5478697f92ab062cbb636461a13
-
SHA256
5428f08f64a656723c1697164b9fe6e2fcaa580448e2cea9787b21a80631091c
-
SHA512
2ba8edd8fff54122dfd3e45f059925281dd9501e16bccf53eba369460585b20f9d74081cc1cce86c141d4f58867525e6c629ab1b8157297bd2db222409eb37c2
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts1:BbdDmjr+OtEvwDpjM8t
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_f96e4dab45951bc3e07567fefc7c5f26_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_f96e4dab45951bc3e07567fefc7c5f26_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD559eef20be95e9a476a0ac90e4a1d7b90
SHA1154b6ebc858aa5a79679d3afed9307e543118f2a
SHA256e7cc1e31fee628c1e8c62b063dc33003f748995460ebebb04992b0163bed095e
SHA51209bed9f57545bb05bce71ef7f5fb7b0e8dd17ca2bdf5199a89474480cf5946f689aa8911d9c0e2970609909917b6eea1360c6e316cd5efd938847cdc18c63dd9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB