Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-05-2024 20:28
General
-
Target
2024-05-19_60c5af849bf3a02d9ca3f3329548bc37_cryptolocker.exe
-
Size
46KB
-
MD5
60c5af849bf3a02d9ca3f3329548bc37
-
SHA1
2251a273aec74cb9a1690481fbfb2259cf388c43
-
SHA256
2270328cc4bb6060fa776d6d67fc1d5cfdf0ada5fcdb7a727f775d94066a2cb0
-
SHA512
04bd11f41d7650a70139dc8b88451a701d3739f8894d8744b7e9ffbf3bd321a000a3224271f1901d8dc55cbf1b3cb0214523b4fb09f2167af8cf48b119be504d
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoL4:qmbhXDmjr5MOtEvwDpj5cDtKkQZQO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_60c5af849bf3a02d9ca3f3329548bc37_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_60c5af849bf3a02d9ca3f3329548bc37_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58ce86f29dd501cd5409bfb8e6bbc3e8c
SHA191721fc9b8e531bd5a0aec70e657e98383570697
SHA256ebed163fa1b17976ba6cde8c62911acea1055217338b1529850ee9b0431d8795
SHA512845eebfdee70fd4c14aef51f25268fa0b20b112050812cbf639f1bf179cfcad68587eeeb698111c8793fc6a45b02c56ddb54fff8fd7a04a9c905ea04e8cf691a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB