Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
29/04/2024, 03:52
General
-
Target
2024-04-29_d27153a398873e585ff7b18718c76bff_cryptolocker.exe
-
Size
40KB
-
MD5
d27153a398873e585ff7b18718c76bff
-
SHA1
01cc539e7cbd3fc30dc160d2a4ccf82ddfffd058
-
SHA256
fbd3aad9896f1b0b48669ebeb5380be010aea7facbf702b2bcadc71f6f9a03fc
-
SHA512
c9c48f4d366282776a24b7e27b49fc9a553cc8595d666dac17c130243db7dfe01d0e454c822185275b0e5fa850e52bf8a686fc4469bb0236189aacdd0f1ff0cd
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfrd:X6QFElP6n+gJQMOtEvwDpjBsYK6rd
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_d27153a398873e585ff7b18718c76bff_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_d27153a398873e585ff7b18718c76bff_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD57edd5902e0977118ca640fa08cd3461f
SHA1df4a1b63f6d5558c9dde88ced8a7262f9b0e88a9
SHA2565b911bad315b30803ac83f284630f60c963c6f2271f711c654a74700de74eaf1
SHA512257fcc5a2055a1da087b7fbc43bbc407eda781243cf7692bf966600fd6a253658bc4042a7885bda9dfeca365b45f7eb5f93b8902e4204e4a69235bd288d67c95
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB