Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
20-04-2024 16:55
General
-
Target
2024-04-20_b5f6b03a4a9dffc5b65e03ff138bf34a_cryptolocker.exe
-
Size
62KB
-
MD5
b5f6b03a4a9dffc5b65e03ff138bf34a
-
SHA1
cb5d19d51f4340cb3172be1a82cc7f37b57ea10a
-
SHA256
e53cc83204b211d4eecb9020ee1f5ef16109b6db0452590002cb3072fd926cb8
-
SHA512
a5e4f42ea513990f98d0de834ea19b48ec8982ebfb5c73002d7ab21e325606f5a34e7a59e1d2b92ffc38dbc78b5b977afacb19df279cb7bda8651f9ff9ea9fe3
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiK:BbdDmjr+OtEvwDpjM8n
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_b5f6b03a4a9dffc5b65e03ff138bf34a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_b5f6b03a4a9dffc5b65e03ff138bf34a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5aa6c4c79a6385e29f7218bcb72e39b72
SHA187e932bc757398d470fb8b657c996686e4106b3d
SHA2567b7a19bdb483fcc3dd9d48387000ec6e66b68f0b49a8dbc1ea48870b9ddcc443
SHA512df2c2414c4cd33039402371a238e6d3f7af4302629c1fbf2180dd79a0eb82f53b48d5e56bb85da9fe37e3776af2b0fe626c7828d48c55b4ec4718f34cf04c45d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB