Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
21/02/2024, 12:57
General
-
Target
2024-02-21_84711d2385fc33edf0c833b04851914d_cryptolocker.exe
-
Size
51KB
-
MD5
84711d2385fc33edf0c833b04851914d
-
SHA1
c4fce41cd16b2809033e9d95cdfce47855e64a5e
-
SHA256
9b5cfcd761714461016984f370d78dec8df616558335e930cc3d950f5ea4e064
-
SHA512
8c49b9b92ac242d0dadfb7cc2790f74f5ee640fb34dfdbfd725e980a11957982783ba4de90a7a373aea3f05216e619787d979585c5ae14fecdb934d6954f8edd
-
SSDEEP
768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTb7D/T:bIDOw9a0DwitDZzcTPL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_84711d2385fc33edf0c833b04851914d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_84711d2385fc33edf0c833b04851914d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5fa1afeb594067e1e723272887237445b
SHA1e905c3ad99d1465436b24b47361c2f272bf350c9
SHA256784f1777326b6ceeb70c4bc51ff49bc4160e6fb622131fd01ab915bf28681f66
SHA5120075062c153344e2f26096992c405b08160ed910acbc4cff8e629b0e37cff03f4669e3962825c53afb26f027bc9848eb33c5ab1977fdcd8fe42fbd1318a758e3
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB