Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 01:49
General
-
Target
2024-03-13_a5932b9d0b7213a43c0694c187714b77_cryptolocker.exe
-
Size
69KB
-
MD5
a5932b9d0b7213a43c0694c187714b77
-
SHA1
c0989d243c23363385b5582c24658961f7e2a419
-
SHA256
5c0e3e7cdb4158c01c4296739004a7120d9f5efc1c7b0c1c26666f44c6dbdbae
-
SHA512
6ae3378830c0919a0642205973d42fb0cfc125f48dc6b523e9b0544a301b3b491fa2a65628a9542e1759074ff6f1d581bbd5d7e4cc3d2f52d53626e0af683a54
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUsMx:DW60sllyWOtEvwDpjwF85n
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_a5932b9d0b7213a43c0694c187714b77_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_a5932b9d0b7213a43c0694c187714b77_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5c5a0dbf3666257e1390a6a4ab17d592e
SHA16a7387416dc3adac4711c5bcbeabc3ae421d6b43
SHA25639da94a51ce6cee81e9810250ff9550a382761934234300e394eb8e032b47076
SHA512d4149b5e24b04ae33f4e2ddb7f488976db8935481058057e79053dc203bc9440033dfe1ada3e77eb7d67cf51f3ae5b93c99dae87f789e79311a972b1e6b8f2cb
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB