Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-04-2024 16:32
General
-
Target
2024-04-16_770946ce6c3a5460d1a738f5841e0dbe_cryptolocker.exe
-
Size
79KB
-
MD5
770946ce6c3a5460d1a738f5841e0dbe
-
SHA1
f3010cb027fb54a8b8591452380571cb0a30b25a
-
SHA256
5877621fc5943e6226e8561418fc02994736d0384ab1ab6537ef2ab9cef1ec9f
-
SHA512
65e07213403ab82c7f1572b6d9c6d69ad2dba4be16ff0415cf2a0a2aa69e49deb0108569b4fd6a13dbfeadeff6139cb1a18d6b1ef20cfc79c974d0747ff08522
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7Qk:zCsanOtEvwDpjw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_770946ce6c3a5460d1a738f5841e0dbe_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_770946ce6c3a5460d1a738f5841e0dbe_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5c63c07e300bd505b30529f8bb69f1247
SHA19b8694553651d996c455ac471feab50dcc99447b
SHA256620fad3acca4d948ab45dcc157db3db66a36c56631f67e1c4d9b1777ff2037a8
SHA5124478e9aa604c61fa99af6b7499c89afa510d750fb93257cac24dca0d6750b05c394306189617ffb640211ac515cd3e4bf9bcfb0740bd800209f3f3a5d9aa59c5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB