Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/05/2024, 04:33
General
-
Target
2024-05-27_5c0f73ad72220a9ad911096c31914605_cryptolocker.exe
-
Size
51KB
-
MD5
5c0f73ad72220a9ad911096c31914605
-
SHA1
9656a084073a3ceb3ab274af2b7a7cb887f28575
-
SHA256
19dd692c583f26c52c35ae64635ab3b01cbfe66b16d2a38a4b7da8f9f906dc4c
-
SHA512
5b2b75e532a252a44ccf3517f1e5ec36b19623393c2f7c7cf36e07c4436a9ef9c5c522624d823bc0eeb8c7cd57825a338298df3946786b4dcc9da633f1338663
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mocc6:qmbhXDmjr5MOtEvwDpj5cDtKkQZQo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_5c0f73ad72220a9ad911096c31914605_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_5c0f73ad72220a9ad911096c31914605_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD51517c446b598177bcccb64b23c4a3c7f
SHA1c5814981c73eb661a3e5dde1c3b2f5cab7630404
SHA2564f83c735fa8c45041a0c329a6ce00e08c74f482f63420f7d9e7764f975835d61
SHA512c59e3d829303f92672a2a7524fdfd542311d912508bc72e9477fdcbf077ae29fa4537a0aa754e024c57c50ef32710ae376d46c6380a1f0c39179ef8edb2c7693
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB