Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-02-2024 05:17
General
-
Target
2024-02-24_d5c2051ea1d5f07c7b2fc667c85b76b2_cryptolocker.exe
-
Size
82KB
-
MD5
d5c2051ea1d5f07c7b2fc667c85b76b2
-
SHA1
3a3d0e69244506eab0d831bd4c6b9d3d302afded
-
SHA256
9d1374b6d5910873fcebc199ff6bc58245c6d7030791b7e12dae4856bf4516db
-
SHA512
f2ff6d15f52e1386763f770b6019207bb56e328cb31369520a796bf5ebe9382e52f2417b52474a81ddba0b635c144522ab30898a97e8006c465870e770e430c9
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kyJS1Q:zCsanOtEvwDpj2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_d5c2051ea1d5f07c7b2fc667c85b76b2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_d5c2051ea1d5f07c7b2fc667c85b76b2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5000f85a802a756401812c3f9f7de3034
SHA15650731d09b62b8e59428d5571ceafd436db49f4
SHA2562f15767c3ce7a441fcde4b12420f94b99df66630e79fe11e33fac22ceeab77e0
SHA512b648b51e6c2583ba427cfc675c6316d1500dcd3b54366aec4ff66f4b6120914ebf1f1173534d771e884c5a359cb74524f022dce4a4f12d66dff6ffcd47a1bde9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB