Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-04-2024 19:25
General
-
Target
2024-04-29_0d6f4a3a0db78cc4695d8ad0054e1908_cryptolocker.exe
-
Size
47KB
-
MD5
0d6f4a3a0db78cc4695d8ad0054e1908
-
SHA1
e75365a1687298779f4d07c36ee2d0d3dc180207
-
SHA256
1c236ebe77fef69f8763766e56ee2619068c5ebf6970ef87972390e9c0585121
-
SHA512
6d7af8d52db50e1b56e4802c2335d6a2fb799e11c6074e41808b2552d29c434a65a8900d4be6ba84a20a4351df5a68da8e6bce4143bd807e7e082e7a309fc8ee
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoL5x:qmbhXDmjr5MOtEvwDpj5cDtKkQZQVv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_0d6f4a3a0db78cc4695d8ad0054e1908_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_0d6f4a3a0db78cc4695d8ad0054e1908_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5e7f4c1c0ba6073a371a4e357bc41a267
SHA187798568bc4e72744470472ad0b1cdbe9f7d986f
SHA256a87e36b5b7696bd94c9f9b7696b08f93139d052fc8909b37e24ee8cbe00aad86
SHA5123379190c508c19d0ccc3d1e3ec45dd9ce6ee95dc6b0946fbf9133cf45b0af5a5fdd591b40e04f45b6bdbc36252c73921bf5433a3f7df8a89c5d6db434ab4f4bc
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB