Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/03/2024, 17:01
General
-
Target
2024-03-18_1c12d77959865d54d312af571faf13a9_cryptolocker.exe
-
Size
62KB
-
MD5
1c12d77959865d54d312af571faf13a9
-
SHA1
f042a44c7e79412b3c3548a10bf786fae4c6e618
-
SHA256
6321c9f69c66f919c41e422df884a8be5739520033e1d1219f4b912cb196a019
-
SHA512
b2a7c722c3890c9ffb63fbdfaa4dd786d5390fec922fc15f5b7eba5ae0906ce5f4e436c2df5444d98a3712b823a44f7523c1c9986f8f338ba6ae7069c57395ad
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts6T:BbdDmjr+OtEvwDpjM8O
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_1c12d77959865d54d312af571faf13a9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_1c12d77959865d54d312af571faf13a9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD570ae6f255238dfd6d9431b49fdb3a337
SHA1e9a4cc1bdcccd00ae9c87b990ddf5a3ffa248658
SHA256c3f8d236598a5bbb232b3dcccf0331d3ae7fb8b0a99b5308ae5bdbfeb2cd290b
SHA5125e0cc5431bd5bc689f53ff777a40083eedb7b8439686bbc977d82c1283920882c03e44e1cb7e06cfff504c2033e18a4c2301393df68d102c8b6a81efb3526af6
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB