Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-04-2024 11:26
General
-
Target
2024-04-09_19e1ff5f8c26cdba46a5bb02d10a94f7_cryptolocker.exe
-
Size
46KB
-
MD5
19e1ff5f8c26cdba46a5bb02d10a94f7
-
SHA1
10da5de99d44e76cd92bdcd57bece8fcba211e85
-
SHA256
f8f7fddb1819d850db3effd561c1fa16841d875dd4c9416ea92df22950b17f93
-
SHA512
79ebb93d3a1cacd6def827e41a2ea0dc2de044424dc1c3d04bb030036556ec5c57dd73254883b821d74fc5557f065e90f7caad5ac8712d7fe8bad96d92fb4da8
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkc5:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_19e1ff5f8c26cdba46a5bb02d10a94f7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_19e1ff5f8c26cdba46a5bb02d10a94f7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5c56ab74c239d445463c6a8f59f1afc7b
SHA104359c2be93d87385ef3be27a3ef8fbd6b109372
SHA256cfc96648aa0efb6434c2134d19fdf496fdf1753864ab706c3a727e0497764593
SHA512564d592829c54931095cd63a9a6cb50de03667ae4c67f0a0777ac4a91d77f20fc589e3ad44585ada4ef26db8250e5d17f120031a772e8c11ee779e8e99cedbb5
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB