Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
20/05/2024, 06:37
General
-
Target
2024-05-20_5b67cdb793e3335bb39ed0e136d84b46_cryptolocker.exe
-
Size
48KB
-
MD5
5b67cdb793e3335bb39ed0e136d84b46
-
SHA1
705fe65896bf35228ae20f2fe0fc7bbfe5196d8a
-
SHA256
cbd83e1fd221da431a297a17be52b4a9ecd7fa308a3b07f5f6bdab614c9d3744
-
SHA512
45dc4c85aa28de4f09c0a4fb6924cfc1437af3f4c47593cd14ea17595542b8e2dbad9b65e1ab243aa58d56857bc24747601f26404fd40d5f19620afb50b95a0a
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoL5Y:qmbhXDmjr5MOtEvwDpj5cDtKkQZQVi
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_5b67cdb793e3335bb39ed0e136d84b46_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_5b67cdb793e3335bb39ed0e136d84b46_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5b1768ea9da8b3161a36e81a14a779596
SHA1cb26c28be63e4b05f4a942f5ad8eaa8f5d357c3d
SHA2567ab539ad5b893e74bff53bf25e1f8b5992cb9b9edda994406be4bcbd0a5aa6f1
SHA512ccf2ea778ec3f0cd911a90b5cbaa13207824ab7f9a45492b5ef077ea2c8972e18ffa5a5465dd8b1eedd4fdb5876cbb04852b9c66f656f6bd929007ef2b6462a4
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB