Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-03-2024 17:26
General
-
Target
2024-03-11_2534f1a5c8c71903be37ceb1b607a088_cryptolocker.exe
-
Size
79KB
-
MD5
2534f1a5c8c71903be37ceb1b607a088
-
SHA1
6fc02d35da10e8b48b3d6e2f86750ca544934bfa
-
SHA256
b099bfa83ca0438b9a8367bcf3b105040d5df8316a7635f6edfe4d98df314178
-
SHA512
37488ae8298721c6da2c34787e573e4a5c48868fcc1730bc5c9c7caa886cf07ff5400b441727f7b90b8cb2ebf32f2d17fde00bdf2d522a5e6cec3813539da36a
-
SSDEEP
768:zQz7yVEhs9+syJP6ntOOtEvwDpjFelaB7pBlqrr1HBJooSeKzu1adyBM:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kym
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_2534f1a5c8c71903be37ceb1b607a088_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_2534f1a5c8c71903be37ceb1b607a088_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD50679cfbd7898fb22336099bbe82cef65
SHA1df5892b16e40540a745aaec7e415729f85637018
SHA256851d699f26222debd21c698edf2d0c95c497fb8a6f7d01d001e657e3e9e9c834
SHA512d76559b33766cd462ac68bd0d994aeccc716a649e322f6d802d70b1ea1d0f77b818ccdd1e456003fc0cb8bfb26dab602f002a83241f8876856e3f51806055b48
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB