Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
22/04/2024, 09:05
General
-
Target
2024-04-22_c383f59fe8c7ac8fede522538a56bb9d_cryptolocker.exe
-
Size
45KB
-
MD5
c383f59fe8c7ac8fede522538a56bb9d
-
SHA1
6a36ad1d7595c513e844995a24993350b2ce1b7c
-
SHA256
04518262aa43871c250d023356fcf6241eabc6751287b920bea5e3a054e433b9
-
SHA512
1bc64786641f8302bcdceede2997448d58c6f8949e73312fa12ec91047fd7f21dfae592294b12cff85b58963b433d14f0ee18f3160f6fc0d82c84627473fbb25
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPq:P6QFElP6k+MRQMOtEvwDpjBQpVXv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_c383f59fe8c7ac8fede522538a56bb9d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_c383f59fe8c7ac8fede522538a56bb9d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD56db794c9fdd449adecf441bcba251ef1
SHA18774e35c2adffeff6ccf08a1b35c904cb6400bbf
SHA2566d595f0459a820e31ff6ac4147789db15f30342e4d572c87de64c4768b7df8f0
SHA5123a961dcdb50e51665084687696bdd4de3fbd2f3a6fe896e995e6e1a59560ce1bc6bcaa2ef4c1fe10e484db786ad9fd1b815da15ef776e19b087f6a7a5d67649f
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB