Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24-01-2024 08:23
General
-
Target
2024-01-24_15faeac45c061f778df7fb109304487f_cryptolocker.exe
-
Size
89KB
-
MD5
15faeac45c061f778df7fb109304487f
-
SHA1
dc3a0569cbc18a5afe4a80c23eb3981929dc1c1e
-
SHA256
4c0c6e940453a5a274c40fab22c320434b1ed3a9e2e569d4b3c1eb51eb7092c7
-
SHA512
8dafc102851c6725892f4edfd1a3f25ec332257c61396028bc6504860b33f2811b83f71976c0a92db13d89cfb42f13e17f06028992c441d9b372e1b996d8688b
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRMy87+:zCsanOtEvwDpj+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_15faeac45c061f778df7fb109304487f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_15faeac45c061f778df7fb109304487f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5cbc284c20f1de2eedabadc65545e825b
SHA16e5d1f0adc5eb3d057c49fa163d5415ca636423f
SHA25692c1754c03583b506e8503174b7ad2b4489fdda15774ad677cf314c17e6d12fe
SHA512f42f77262a87203be6f8d2e6248e37af05534397f72964e34029672fc27edfed348d2a075ce6b325df9dcf8f8ef4ea910048439e0287a07f1245ae4c9b227c1d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB