Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
29/04/2024, 03:23
General
-
Target
2024-04-29_06717a39ff2017e10effc3ee7b58eef8_cryptolocker.exe
-
Size
62KB
-
MD5
06717a39ff2017e10effc3ee7b58eef8
-
SHA1
480c652b8e56be7a2802c16b1f62595acda7b71e
-
SHA256
76c202c35cd0cf1edec55c67780c096ff920a46e8e7a40d9fcaea63fc293dee0
-
SHA512
3780ea228560bcba88ecea47f999cff9d24ae65dc9663fe60c6444077bf034a6e14c90ba4062ebdadcacfadee1bdba60a30e9ece725b656550eef2dad681039e
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiK:BbdDmjr+OtEvwDpjM8X
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_06717a39ff2017e10effc3ee7b58eef8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_06717a39ff2017e10effc3ee7b58eef8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5325aabf0aae36de3f3a40ae34165c4db
SHA1e734069e785f0a12409e49cb095c1ba50a4b7302
SHA256cf5b3759202b1a3c9c458e00ce2df6215d4e9d36c10f6c915a272ad37321fcc8
SHA51284237cd4b61c5c5bbbdc38352b37dc4de1614188b30214d9067afabf17b0563ec613860a7819d930b79dc2bb0a8e0bbd1c378c5766449767d5684751ff2476b5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB