Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/04/2024, 12:35
General
-
Target
2024-04-19_544c3e350553f38f5a3a23b1f306b39f_cryptolocker.exe
-
Size
79KB
-
MD5
544c3e350553f38f5a3a23b1f306b39f
-
SHA1
9949703cc9c7f5c4d655c564e9f443cc0303a249
-
SHA256
8077da388a319e8493f1e69510edfe97e4015fcb86de433dbdea1366ff3d92da
-
SHA512
e95614e27dbbcbeef939e889a041de1e17d928ff477b406fa064d458103892579dbff0cef932df4d87d674916482578ee685735cc4ba631c7dab0bf53abf1615
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7Qv:zCsanOtEvwDpjL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_544c3e350553f38f5a3a23b1f306b39f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_544c3e350553f38f5a3a23b1f306b39f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD53375ef39a22a4ce17537c6be6b6873a3
SHA10bf3aa73c50a8ed67d564c7c0f9b9971adc0b9bd
SHA2561e98639939e7868b37a787d18e99aa5c3b6ee9391e8438cf657aaefdeae7dffa
SHA5123b5cd86e1ea8a8ca0641917682204f2c9095e6183218c1714b8e675352de73a48d19b0881771db8e7692dc7184ce60fbb927e3c62f3374a082aabf5a85639f21
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB