Analysis
-
max time kernel
131s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 06:23
General
-
Target
2024-11-02_0a66a4327d5b02afb9c69a7ef413f517_cryptolocker.exe
-
Size
31KB
-
MD5
0a66a4327d5b02afb9c69a7ef413f517
-
SHA1
a26e496e41e9b2066f398849e6592ccab3b76e4e
-
SHA256
bf28df29ae2f93e2b50e2a1d8a85b5c107958595fef2e95ed53b0af172d4bb3a
-
SHA512
dbb7b35f4784e544fb22113afc947d5f1dbffcf0f2092b15a0add24104751d99e0bb68e1cd70789a90250298c1769f727640b6eb762cfdc1e22b2c9685190f0f
-
SSDEEP
768:I6LsoEEeegiZPvEhHSG+gbIBrtOOtEvwDpj7J:I6QFElP6n+gs5MOtEvwDpjt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-02_0a66a4327d5b02afb9c69a7ef413f517_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-02_0a66a4327d5b02afb9c69a7ef413f517_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5185770390f0a264717172120fad605d3
SHA12bffa06aea459489235d6b2cda34989ec3a2c0ac
SHA2567e8c7900ace71075c49379703c6a32472f846db9a90e7198ab8d3c9dc1407153
SHA512a3d1199643d23d933e6dff3e6392ff0de1705397bc066810c05ab80281b5faa2552a1fad9294cf0465fc660111631215f3dfce9d24790db162c74c9cde3c666f
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB