Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 10:43
General
-
Target
2024-01-27_cf41fdc5599af5ae182f4cffdb4f13b2_cryptolocker.exe
-
Size
35KB
-
MD5
cf41fdc5599af5ae182f4cffdb4f13b2
-
SHA1
f14d4aca2b22bb09bf54f340e64812159ed4e2d4
-
SHA256
70888c78029824e1619a68627b1f49a252f9b461292ed7ce00c11533983b7e78
-
SHA512
ac33b492a040ae3b0777f969a4bc70294dd33f775b234e6ae7bb91b4bbc8b6d53c685604c51f6b7070c59bb47323663e7d78fd7cfd950d2012629a39761ad44c
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPY:YGzl5wjRQBBOsP1QMOtEvwDpjgar9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_cf41fdc5599af5ae182f4cffdb4f13b2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_cf41fdc5599af5ae182f4cffdb4f13b2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5e7e06b5ad0dea023bee3512d7f5a1a3e
SHA1ede4c2e0606f7e45a8b5b162d80c6c5d4bc2f897
SHA2569d159e1ca35e13f59d8b8fdc32253b207da86f96f9bbb82a7b79dc7a4620c371
SHA51296d28cef35c6ed2c4ac08377d1f3f0d3ec60a0b82eaf75dd8c68a86fd87992202832204a406b025763286e6d6627a4c58c45ac29dc5427854517ddda9d583474
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB