Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
04/06/2024, 05:29
General
-
Target
2024-06-04_2c785abf5b3ae06b806f84b6c6b41503_cryptolocker.exe
-
Size
47KB
-
MD5
2c785abf5b3ae06b806f84b6c6b41503
-
SHA1
b21ef801ce229f011a398f0cc30a5e0440b58f44
-
SHA256
d7028a55d150f6e61beadf1086dee378240e9fe5f8677f4e3d0d150584eedd8c
-
SHA512
0d986e48b5dc5501a1180f1da39ac52476eb2b1dd02400b50de10c74744409954bfe0f0474ae1088d0c13c6067129c6c0edb84d603817675182e10a05c395598
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLL:qmbhXDmjr5MOtEvwDpj5cDtKkQZQR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_2c785abf5b3ae06b806f84b6c6b41503_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_2c785abf5b3ae06b806f84b6c6b41503_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD526c3f4e34a1d9439de706bd70477bf0c
SHA1a87b8cd1816a449d2d74541028e53bd7035db713
SHA25629cf842b3ada792cbec08e7a22f75c415c16782c143f25c3db5e00dcdeb86791
SHA5127f512709600eb028bf6eaffd67c5d74d5490c078187bbf80fa402adc83efc104476f42edb3a329eb5eccd11719c70db4e6a1b6246d20d3e43ec605d8011d492b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB