Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19-03-2024 00:35
General
-
Target
2024-03-19_32a621f6d274f11c39ee90b52f43204a_cryptolocker.exe
-
Size
82KB
-
MD5
32a621f6d274f11c39ee90b52f43204a
-
SHA1
092d6378aeb11523e062b547d1e055c1521e213e
-
SHA256
7b316fbaa6531dcd917c983f6c41f1eaa71cff9a7472b719053c4e5f4e54340d
-
SHA512
173daf07fa7489a1d244a2e67ac6f3502c4be8743db52d54c68e6eadf9e40fcb706d78aebfd9656ae7167cdd35f18c65abff8581fd72f53e784621f70ce8af7e
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kyJS1h:zCsanOtEvwDpjr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_32a621f6d274f11c39ee90b52f43204a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_32a621f6d274f11c39ee90b52f43204a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD58d922be4838f14ccb00cdd3dcb99f088
SHA19af6d960aad00f04d5309474da810736fe0ba81f
SHA256ab580600ceee204595885e720ecda437f5a6226ab8e1e82d5421b49781773439
SHA5122a6762bb085091b1a5fed7940599ea6db1bf84dad7346e80a317a7fce9f5b238be637487f6bef5db3738af7ece1843f47901b8c99d36a1b83d332bc66ca0076d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB