Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10-05-2024 03:56
General
-
Target
2024-05-10_6cc0fdeb722b7af5ac9988a03e30d018_cryptolocker.exe
-
Size
50KB
-
MD5
6cc0fdeb722b7af5ac9988a03e30d018
-
SHA1
8265dd4e4b053311807854b11b3d6e5374464e04
-
SHA256
dc7779bcd7a1b2bc1b6643ea92ca13a08531c3aac6bc89e40e15b623f5624311
-
SHA512
57448f7a8b47616c8f1a31f5e3607f1fbe45145accb5bc56b5d88c1a1296a9bba393710779569adb11ba62a76439643d0c1dae82227d07154eb44a5873ad238f
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Moccn:qmbhXDmjr5MOtEvwDpj5cDtKkQZQx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_6cc0fdeb722b7af5ac9988a03e30d018_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_6cc0fdeb722b7af5ac9988a03e30d018_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD578818da0bc423e1e04b662f77e9c5b6f
SHA10bba055f62929dd848d8877c65591702cf0247d1
SHA256a8e25915c789a2206b85521b626c26f8700853236e4e9ee4b833db8f36c3dcc7
SHA51254adfadd8448613c712ab3b446477ab09bf9c9fa966f48574b6a09c0ba1f6107fd1620ace38435b42b73c9d4a0561a232d733b32dc443579fa4b0dda62d43a6a
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB