Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11/05/2024, 04:27
General
-
Target
2024-05-11_13ed9ca86ede7863e9b0c33ff835c572_cryptolocker.exe
-
Size
56KB
-
MD5
13ed9ca86ede7863e9b0c33ff835c572
-
SHA1
48e7a76817104f0dd8fb600c4a5d8fca81b9f936
-
SHA256
0c5ca7fccef3674cde8c440462e45cc6fc624a2df27589e7546b1d25f049ee1b
-
SHA512
df6d238dafde60f666402b23fb5b8d55b86bdb6e5b87ae2c7308e9bf89f8724302c0d4026bbf3ddedc96d0298d20bc5a7afab8cee20f67f2ad853e0b97028437
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impy8:BbdDmjr+OtEvwDpjMv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_13ed9ca86ede7863e9b0c33ff835c572_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_13ed9ca86ede7863e9b0c33ff835c572_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5546654cb0dea3b070cf7d38df9d9c307
SHA1fbafb1fe2f81c8610d4cc5c55468a014e354d59f
SHA256864abc1b665868fd0160f2a14921950ac3e8e2a0dddfe8cf001435e5e4ae9285
SHA512a21133ff93955683c3b0fa4a3c671a9c56782370cdebfebd5c6de2976b2f6ae7caa5ebdfc19774f7c31944dc72789d76902202c846a075eac0b70b440765bbcd
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB