Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
15-06-2024 03:34
General
-
Target
2024-06-15_89c54838ca23310b0b0424ca0f733562_cryptolocker.exe
-
Size
48KB
-
MD5
89c54838ca23310b0b0424ca0f733562
-
SHA1
822f8cb984eabcca795e4974660985ab9f9e4666
-
SHA256
84842cc362c6e24a8b57f9ce803cd0bba87a5b56c821e4cb33d7506f8a16c636
-
SHA512
7e5458833e563b55074106f3724b4aadedc0106aa35a2934a2da63cd613ff4311a2515ed2cb7899a2bc7681c7dfb7789180392b25569b712f5617858772928f4
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkz:P6Q0ElP6G+gJQMOtEvwDpjB8WMlo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_89c54838ca23310b0b0424ca0f733562_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_89c54838ca23310b0b0424ca0f733562_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5e587140f09e7798cc8749952dacc4531
SHA127ee50ccbe2a6bcc332ad88b15f074978c9e79ff
SHA2568ff7d69746d6757eec19e35d2bf15e66354fcfd97c41ec9d584c82c4e7522be0
SHA512fae9cd2bec3e2bc695b26acb9207ab470d1de4ea93428be99d875f3a01c795d183f89f7d9a0a63b4e84c1d5d7efdfc8441e5a2fc8a1609f45ebe08e8154a293e
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB