Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/06/2024, 00:46
General
-
Target
2024-06-05_1d4b995e0e3b11afd992b45a1b6e7667_cryptolocker.exe
-
Size
46KB
-
MD5
1d4b995e0e3b11afd992b45a1b6e7667
-
SHA1
d770b13d5d4a150533134d3048c9f25462a0f6b6
-
SHA256
eb2375c5e3d007c17e145c363c79c01bba97f85161bdf238684520086071df51
-
SHA512
c075a9d49c555d0362618357a7e2c8cf056cccda8bff3042c164de92ab9bce652e1b497533031864d5f3a66ab007cd5c504c1ae7999970136e597dff13c7d408
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPNy:P6QFElP6k+MRQMOtEvwDpjBQpVXEy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_1d4b995e0e3b11afd992b45a1b6e7667_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_1d4b995e0e3b11afd992b45a1b6e7667_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD50a39c64a091b26e14c18526dd0b10d6e
SHA15920395364475e069b6bdccd7c04d14ba2848f53
SHA256365f2551f1a1bc6ffa8b70800ca7b8c6fc03cfba802f830e16c04de7b66ca749
SHA51299861202052d3b47b0b15f14ca8f89512d6b7cefe37b858179ff2f10c112db36cbde7e6584d21c9457928b88d1586d324e6dc81145e1f52ef6cf59875aada628
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB