Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
02/05/2024, 05:35
General
-
Target
2024-05-02_46c441ca7d2c1a33fc195b6e37c20ea3_cryptolocker.exe
-
Size
63KB
-
MD5
46c441ca7d2c1a33fc195b6e37c20ea3
-
SHA1
2d4fdf4d1633bfeb93602f2aec64bdba03c9d858
-
SHA256
0e38671a54e09ac0921efe342be5c9380e39cac216aa80055ea9f88e4a6e6963
-
SHA512
4eb77187bc335e999c4234071d17436e512b3ede84b339323c66740a9d007dbcdc020f53ef5747a8531191300c690ea700bfac819fd8f6c2f6996ee5dccdff39
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsig:BbdDmjr+OtEvwDpjM8Z
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_46c441ca7d2c1a33fc195b6e37c20ea3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_46c441ca7d2c1a33fc195b6e37c20ea3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5c8838718fb7037b7916954da780cf946
SHA1b239f4cb08063ba7ce01e8a28c52f2141cb100b7
SHA2563b8d1aa41228c578ca454d7f2a8591d07c5d88c01944d1c5d810e2cb00cf1119
SHA5127ad6c4fb89a7614ec8d24e4b9a3a0ea4f8794e77896ac60f6558190ae0ffffe70460c2929774c4dce05bb77363a5e661fe2cc1c06d7fdfba8f28f8808a368eab
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB