Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 23:36
General
-
Target
2024-04-10_ad458e32b4fe59afbc8f3ee11db92970_cryptolocker.exe
-
Size
46KB
-
MD5
ad458e32b4fe59afbc8f3ee11db92970
-
SHA1
8424befb627a6802262cb05f803cc356695c82fa
-
SHA256
677821271ecac8a5baca61bc9016a046b53e680193131f85e2fa3c820dddba39
-
SHA512
a127c28b414edea723638ddece4b9a66da31369b9ee54c3f5de8e911c5a0f8ef2a0a199cd650531c8021ebe4e74bc767b0203bf5201a1a89cc5510c07b869c21
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLg:qmbhXDmjr5MOtEvwDpj5cDtKkQZQW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 7 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 7 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_ad458e32b4fe59afbc8f3ee11db92970_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_ad458e32b4fe59afbc8f3ee11db92970_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58dd8a8b79fd5a90d38449d9f17e1e63c
SHA16deabb0e2fbbe8ff42e005f73bddf2b80853a495
SHA256dc4f2d298078089a02f1e7a6571d2a93b8acd7c45ad973f9e862e4c28a9cfc02
SHA512e118858196968953a3bae466f15e09a052f7caffe95e953766e9636f4d8734dccec3fa5ad8000df4c53c522300d4d297d857b1dd630c5943fbe9889fdc47db65
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB