Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26-04-2024 04:39
General
-
Target
2024-04-26_51851a5ab28279223b7f850c552580b8_cryptolocker.exe
-
Size
54KB
-
MD5
51851a5ab28279223b7f850c552580b8
-
SHA1
1b1ad33d187482f544f5da3c49e364ca04635954
-
SHA256
a58a1eff94f80c3491158bbe2d0359e653c31d694130a906512a35f8236ec48f
-
SHA512
b54ca19ca9d85be4c3c5857a6cd4441df17d1c2014e8d9ef5f7f63d682037f188fd09837b707e5f3dfb33fdec137dee3afd762f0b447058da1bfb69cade896f5
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impyd:BbdDmjr+OtEvwDpjMq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_51851a5ab28279223b7f850c552580b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_51851a5ab28279223b7f850c552580b8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD58a013000eec980153d455bd1621e055c
SHA18a3f8d4bc2f7c4e967f2460f6e018356d2508e38
SHA256339c0949d75203b0f18e4326418d83fee37e7f6ed0965c04b9bc301c54d50903
SHA512299859e4f1f7e669503b55201bbb68141724ae0d924edb540596027614fb1756ca30fcfd3c40f850b3d89dcde4e222586caa9a18db543494ce71974dce742ce1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB