Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/03/2024, 15:51
General
-
Target
2024-03-06_da176fda146dda66456b2c20e3f89c7b_cryptolocker.exe
-
Size
46KB
-
MD5
da176fda146dda66456b2c20e3f89c7b
-
SHA1
6ac3ccec0b5098151504263f101cb41726567857
-
SHA256
dd9a6ab0da53fdc0dc788094411b412bb2213845a984f46c691c7883397ce849
-
SHA512
7158f591c06061f50282b28bbf8235cc375f5636be5ea1f9cffcc48753f6b868f27ba5e14aa6d7f12a9a510340a26fda696c471daeef7b87f5bf104878712c1a
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mobez:qmbhXDmjr5MOtEvwDpj5cDtKkQZQG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_da176fda146dda66456b2c20e3f89c7b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_da176fda146dda66456b2c20e3f89c7b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5b02c9b8cb26e19fcbcf10c66622c91e9
SHA1feb28c0ddd1044740e79c2fffd5edd37a6353cc8
SHA256955ac69bc1d68c29c4f80af8ffd58b37c69dddfaaf1739df9b2c789433e54c59
SHA51262c15dc20827db3288ce0281daefc1453864466aa5541c55c1c02af7d23a9fa8c3ca216f919ec9841ff6151da4213d21ab08a6c64b842181db3c992d5f841e24
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB