Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18-01-2024 22:58
General
-
Target
2024-01-18_7eea718632648fed7a3d14a00c2aea91_cryptolocker.exe
-
Size
48KB
-
MD5
7eea718632648fed7a3d14a00c2aea91
-
SHA1
ffbc77c4ad764eb54bd60e33d339bb6d3b6be817
-
SHA256
802a0af42b5e6a607b7a25f9a782069e5e3d4a77fc7b62fd484876fae9300518
-
SHA512
2d6ceb269bc20c47ea9598ce9a13171bc431658be76a2654367c2650c92d3713775027d2d32add4c2cfa4e9d0aa0966712bf8dd04215b3297778f078534a6d2b
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnUtAA:79mqyNhQMOtEvwDpjBxe8xt/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_7eea718632648fed7a3d14a00c2aea91_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_7eea718632648fed7a3d14a00c2aea91_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD530fc7ffc04ff7ba1c19f5b01743eee52
SHA16757ed185df55c6e1e5c196914a179b143d57e42
SHA2562fc232ad36ec6606905b325fe46ed55dabb7c1379649d02a0dd503bc1bed4d1d
SHA5125ba5d99f9b558043197764e4a1645faeaf9453e5023fd9ac5575c84b3063912b575bdfeae79411cf95a6dcfb30ab18510e4df087cf5c174265e9828b15a7c364
-
Filesize
20KB
MD5923f821b1a9003cb425f7f9127a354e4
SHA11d23b2949f3c276feb4998b20acc33a5c5201d26
SHA256aa3032f7a0866c132da0bdb55cd60b6ffecb8f00fc173515ca38dc65d39a4862
SHA512c35dd847b064819bdaaa8560b6c594f03192d123eb6221ab5429b99aeb9c773ebf713c7733b6c228a9644c91fb4f800ff3f58a83351175afd13e195e6abf8834
-
Filesize
20KB
MD55aee989767c9d01f0dd069f4cc1bfc10
SHA1eaa342062dff6ef37dae13b48f9089f4c7d53697
SHA2567d7f2cbd6db47d32aa89c56209ee873be8cc5f96865b374bc10244a7a48f4900
SHA512a1a0579f8def72fd688866ad03966aa11c24f43c72e237f54fdadd4992d5ce9c7de053e884e46380a1b427490146fed5cb0aae5fb377ee9d35c3b14f58cbdc18
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB