Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06-04-2024 04:30
General
-
Target
2024-04-06_219f7157381d0d156b7c2b90651b959d_cryptolocker.exe
-
Size
56KB
-
MD5
219f7157381d0d156b7c2b90651b959d
-
SHA1
46e55ea7e78eb6f8d3f367f6a0c9feba2d36c60e
-
SHA256
bbec23a156e472165d001453a6a6d39e28d7e85eb4ac4ddfce6e1571a1dffb35
-
SHA512
c0262eaa57ebdc35da095bdb46ad2d9ddd83c404d0894de7b2030f1b2a1a03dbba88321cbbe8e689b5d1459fa9b0d67c4ea0a81429c33984006b6f6623dbbf7e
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb617xDtK:BbdDmjr+OtEvwDpjME
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_219f7157381d0d156b7c2b90651b959d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_219f7157381d0d156b7c2b90651b959d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5e4d8bc34959ca939c74da91fed9c20d6
SHA12b17ac542fa2825f1ab7fc9d9472640642bf7996
SHA2565bb905a89e8475eb4150af1fe3aa29d630229b8ce0a0ed644d5d1e0f26fe4f83
SHA5120f676de62450f03244997216d2a7a0d658ccb83e582304afc69de49443b2a30b94404237a1a94a9d62b209f1ff36db34bad80f4e03a46fefc1583d3581a43b8a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB