Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:55
General
-
Target
2024-01-25_7931c7a2457da7124da40c942d2aaf9f_cryptolocker.exe
-
Size
38KB
-
MD5
7931c7a2457da7124da40c942d2aaf9f
-
SHA1
3b80cd57196649cd46ae44aa6cddd7ddc1b5c739
-
SHA256
946b33e09f78d4e498539f7f3a21bcec0956f4ff5731451ddbacb7ff527252f5
-
SHA512
aed9d26bde6ffd5d4fce70e11e821dfe9c4a758d818a4d75587610e5877b796a2d8d36d2548f97b3a9382a9d462812759fda2ada25f04f7dc414d7ca4c2db003
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlxur:b/yC4GyNM01GuQMNXw2PSjHPbSuYlC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_7931c7a2457da7124da40c942d2aaf9f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_7931c7a2457da7124da40c942d2aaf9f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD554935ab33309ed8ce2fbb92551b5274f
SHA1d0b3557763afcb86e5653460162a20e5e075be19
SHA256450718f20ba7ce7388e3220aa0bda6b4d39041547a8f2571821b54254be37e6a
SHA512bc97269116d33129606ddfea6b42f0376ffd2db6c3fa85a6d28ff52d625a62f08daaf32a23cd125c52ff2c4f2a73fa282b495e4e2bc5aa214fbb5cee834af2ce
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB