Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19-04-2024 07:40
General
-
Target
2024-04-19_c18103db978ebc6748511b8356643bbb_cryptolocker.exe
-
Size
96KB
-
MD5
c18103db978ebc6748511b8356643bbb
-
SHA1
917655abc16e578d48d437ec40e430576a1c1580
-
SHA256
c770edf30cad35647eae9a72286bdea8c1c7e22b5251f3db5a3bf476bda16c36
-
SHA512
922241f8439e4187c9569ed61b75e74ae1737ad7080d8a4a586dd2855169caed7d3a6764a79bf11ba09568fe45a56d6cbfca7013b23e3def14e6beec8bcbb870
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/bC:zCsanOtEvwDpjB+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_c18103db978ebc6748511b8356643bbb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_c18103db978ebc6748511b8356643bbb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5c3dae2291c00389e6e2049756e613473
SHA1e507e4abd04375333fdceac2b7ead4dc9b9b702c
SHA2560fa6c6b7acf18d0839ed7ba3929bc8bbff96769e29fff9ee8f8410acf0f3e9b8
SHA512a4615a1b0fc243128a22d5e60ae8ebe8b50abbe3203491c4657e17d006e0325dec7da439e1b37294268bd408453c2de2a44882235f73ad8181f22e9bf3482f1f
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB