Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
02-06-2024 04:23
General
-
Target
2024-06-02_1b8ad3f5f6f5b5a25457a8faf43a856e_cryptolocker.exe
-
Size
64KB
-
MD5
1b8ad3f5f6f5b5a25457a8faf43a856e
-
SHA1
d5634a46787bad3cd951143ab6d8fa154c37da96
-
SHA256
1ab5a0fe4fd91bffcc160a6976c06dc6db3ff423a1bd85b8482e7d8400cc9827
-
SHA512
bd90da22fed54f99c339e9a9401e9e0dc7c9d9b7b8512639fd492379ece579b5e6c89129a002160048ba3dcc58d639a2ddd877cae0ce6c1e63e8faee704c5aa3
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiEp:BbdDmjr+OtEvwDpjM85
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_1b8ad3f5f6f5b5a25457a8faf43a856e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_1b8ad3f5f6f5b5a25457a8faf43a856e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD53b9dd5a4dd3eb39455d47c1799ba32aa
SHA11b686cdfcbf31eb382887614cb81b309dfdc9f36
SHA2567fab997c8e8e54edd22d512f56bd1186a84a8ea792ecd08a3573ebe608e0b63a
SHA512cb29971195c8beb0cc491bb2ce210971148866e39724b0bac70dd08f685e35c7b1f3c6623617d91f4dac72b7f92a65cbb045f0c74cd5472d11c082616f0fcada
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB