Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-04-2024 15:57
General
-
Target
2024-04-08_27d8159ed95973936593838684c83fe7_cryptolocker.exe
-
Size
61KB
-
MD5
27d8159ed95973936593838684c83fe7
-
SHA1
8dcebb5a4b5647933cec78f14931ebfbf1412791
-
SHA256
6dc1c11151f832bb89063810b72cff2db9ddd1a24f428d8ed49e587f9aa086a4
-
SHA512
eafde5b6eb3f26f1d6fc2e442a96295d1457b02972a5fdf527e716f1f72567c569a5938d5c67555071908379f0d58439ab5cc33aa83845c067a6667fc814be21
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsid:BbdDmjr+OtEvwDpjM8k
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_27d8159ed95973936593838684c83fe7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_27d8159ed95973936593838684c83fe7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5cdbcf11ed4e1bced985c4f661f35c5f4
SHA1d4d0ccd6c65360dd2b148882cf94d7ab81aca477
SHA25643fcb87d9e80d8de4161a5d37a29224c950d331e58dd02b851efe11db4945a61
SHA512b648e1bdda51c554373897d9bcb0ac8e6bf4f8cd5b0dbddc5666d335ce3aa2a036fe33628fc4380e0c5acf0ee04d4b423fc53c4057a0d4b855f3c7eeb261e708
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB