Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-04-2024 04:39
General
-
Target
2024-04-05_f774f400c5e0321f273d35248728e15d_cryptolocker.exe
-
Size
45KB
-
MD5
f774f400c5e0321f273d35248728e15d
-
SHA1
46e6a7fba78af4b616a9db65848773a604142af5
-
SHA256
e04905389c5f4ebfacb3c7ba1d3f2dc142ecbd75db224e824a5a8139c3b15c10
-
SHA512
c0e94162fcfb03a65c2236e21c7d1c5e15a832d8acdfdc709a285e768024065731fb8493f4405808be25f4c62ab4d35ac1a942be6346590060e8dd0b36d8687d
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcR:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_f774f400c5e0321f273d35248728e15d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_f774f400c5e0321f273d35248728e15d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5303aa18127df8ac58b22e131a514fc46
SHA1b2d229054676d2e53ffda466f7700b0b17dcd613
SHA256324e12d9bf77df0db17f2fb46a667e9d0b8481958739e0443e5c38abd48d4efe
SHA5120af74b37ba7de333ab14e633e7f49348188249395f1ace19a046c3d890418698cc6cf1d52c3da5d8cabde03835feedd175d335c39e80d3d9022f1d54067a2f44
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB