Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/04/2024, 04:29
General
-
Target
2024-04-09_342828c2f1c318f8ff80a814842d8a8f_cryptolocker.exe
-
Size
45KB
-
MD5
342828c2f1c318f8ff80a814842d8a8f
-
SHA1
bcfc3c5ac7750070eaaeb53ef69e5c1363f5b800
-
SHA256
149ee7c3edc73efceae9425f008bc52f2447020e7a19dec578b355d28af90f95
-
SHA512
1690b3d9518736ed075e5c674bef0574c5e6390d9196c60cea9807d0eb664c4f3690eec7985e2e19f752cbaefcdf7642322db14be05e8075596361e61e412fc6
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLX:qmbhXDmjr5MOtEvwDpj5cDtKkQZQd
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_342828c2f1c318f8ff80a814842d8a8f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_342828c2f1c318f8ff80a814842d8a8f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5be282ee28ec712c49c11ad5bf25a2879
SHA1092b74e87af58128f812e2e4d8727ebfcca44cfb
SHA2568d0ab7d1bf3fdc721709a6209c800d076eb0bf9a3f0cd7dfc5d8a7d0307e0a68
SHA512e8c5c0ff3adbb602afcf51466f32840ec308a1f1330e243d438146e4f560bb401f79332ea1a156fa01fb2e22b56c7a2d0d54f26dbde8975840d149b70563a0c1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB