Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
15/03/2024, 00:50
General
-
Target
2024-03-15_cf1afa5c188b0a6c2d8837b669b8e926_cryptolocker.exe
-
Size
32KB
-
MD5
cf1afa5c188b0a6c2d8837b669b8e926
-
SHA1
46cac091f43a41d06becb5cddb5393abf6cb0148
-
SHA256
d6bba0fd63bb89a197c3745a02c7debd7daf5894cf6d64fc54ccf7a6d73b27df
-
SHA512
c95e8b256a862b07dbac4f1847a0e16cf12bd68d5b8089d323f0fa4481f6b9aaa875234c98a32046188b199c03a10addace637b97949052b207e19b10f6f57d4
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+4tHbj7:q0zizzOSxMOtEvwDpj/arqj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_cf1afa5c188b0a6c2d8837b669b8e926_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_cf1afa5c188b0a6c2d8837b669b8e926_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD59e586116fa4fae9e04a63194103d3ba6
SHA162ec91d624d6081d52c2c8be5223225a88610b87
SHA256ceee73267f2b1059637054d4cb3109ad000597b0b6f67e0007b37bb171ef24b3
SHA512e349b27371bf2558db02d8f68b061e38765fe710c80c42e27c9625c79f79adbece908d7283bebbe18c2120e1fef78e12f0da9e8106302304194c7be968b48551
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB