Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
13-03-2024 05:27
General
-
Target
2024-03-13_0e1c7cfbab8af889bfb5d4e76fd6d47f_cryptolocker.exe
-
Size
47KB
-
MD5
0e1c7cfbab8af889bfb5d4e76fd6d47f
-
SHA1
3a6097fd4cc4dca42896a729296967c300bc2d4f
-
SHA256
89e65478fe5265261994bb87be69dd5053d8b9797b29d4b19f1456adf821b28a
-
SHA512
c17845b2ae719707d7e58527e5d915ca97099093b37a94edacc0a5a832c71ddfd91374a7cbe2544c833b52c318e51e0feaecaa97d30cd8d17db5b22999f30cc5
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mo2pa:qmbhXDmjr5MOtEvwDpj5cDtKkQZQj/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_0e1c7cfbab8af889bfb5d4e76fd6d47f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_0e1c7cfbab8af889bfb5d4e76fd6d47f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD566ec0566aff7e07e123651f526c2dbdb
SHA1694d47ccd97caa75fe7450668dbf6d10809f26e6
SHA2560beda79fce20d6cba4fada7e7ed681d5e6f203b4aa27cb36494e47fc31001438
SHA51289ad02a087fa0dd09e1ad47dbec7e9b27d8ef4c45c6cd803560f718d602a67f6c3bf44431b2f19917f98dec8301a47ecd684d738ae95104e6c662ff68cf8850c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB