Analysis
-
max time kernel
132s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
26/04/2024, 03:52
General
-
Target
2024-04-26_83d0d3dfe1d8a3dde2710c70a5520b1e_cryptolocker.exe
-
Size
96KB
-
MD5
83d0d3dfe1d8a3dde2710c70a5520b1e
-
SHA1
6acdc9fc44c932eebc46694e550298d09c5cc54c
-
SHA256
8d6b5c87e798f09fb6f17ea7900d01c7298e8747a9d9975a57e25d4fe2a5238d
-
SHA512
2b7dd96cc12509fa18c570230cc0a006198b9e959bd343ae3e6b461d12e2058761eec8ef1cc5dc1ddfe0d30879e50cebee035e97effaa9570338b4922939bf7f
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/bA:zCsanOtEvwDpjBk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_83d0d3dfe1d8a3dde2710c70a5520b1e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_83d0d3dfe1d8a3dde2710c70a5520b1e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD545fff305d4958fe179f31991cce94fac
SHA14a82d20fdd6fc593d585084e9a2b0ac2c5a29833
SHA256f5f0d551ad51065d9f3c107ea4195745004f514d4fc0628f7786e0eb76825187
SHA5127cd824b68d9bd59af015ce83961ee7f4b8ba046db5c44f01fa103f2d78bb8c9fca0781581c11fa23fcefb0e530b114fd90550106b86d3e21d8ec36d3cbd1d884
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB