Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
15/04/2024, 05:40
General
-
Target
2024-04-15_2ed43dafbfa50c8dae7b15abe1623c88_cryptolocker.exe
-
Size
62KB
-
MD5
2ed43dafbfa50c8dae7b15abe1623c88
-
SHA1
5c50c67d9c9ca1f7c260c18df911f4a4dd647712
-
SHA256
30ecd10d4f2f1311abe77973a557be878fe4b03f14efc3ff3c1d4ff67f76813f
-
SHA512
a56d52186eb280c248dfdc9606b6314ac0cbaa321d36ba55cf6335a29ac4864074c1573891dec1451c82e5534297ccb4dd7e5050d58c91511a39716d335964cd
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiA:BbdDmjr+OtEvwDpjM8J
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_2ed43dafbfa50c8dae7b15abe1623c88_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_2ed43dafbfa50c8dae7b15abe1623c88_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5cc261613303b8e42d9182c3cf3d14a8f
SHA12a40f49b307a081d0b7e06fbdb31200e36ba50c7
SHA256cd0a9abd96b26556d37a18f36e3d4660c8b6f8543041f963046af45c29542e78
SHA51229fcbdc07c89a1956c4b15414bdecbd6ea5478176b93c22b6ebc8be0fade0c66a00cd9a841bacb871f4d9e430b50ec02977b68a5cf535a457b2092b194ea57b9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB