Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
26-04-2024 03:52
General
-
Target
2024-04-26_87e953e96fd0b9a33eafa95c02795cae_cryptolocker.exe
-
Size
96KB
-
MD5
87e953e96fd0b9a33eafa95c02795cae
-
SHA1
b12a277bf1b434db7dbd3a65b5d4a4d9eda49c94
-
SHA256
8e1ebf3deff70f34f117935f642efac09f745b4fb87b69bca6f6ef5245e11503
-
SHA512
9fd07e52c2052c5caf663186531758c38f491006b4c811a339364d541f4093f4296599edddf2e0d64e66e355851b300c0eb6098f32fdd7810760c4a39bc376d2
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/b6:zCsanOtEvwDpjBG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_87e953e96fd0b9a33eafa95c02795cae_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_87e953e96fd0b9a33eafa95c02795cae_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5e3ac05b0184bd7fa3edd20a21892b5b1
SHA11e0005b8dc315b2043408d8ad4dc1120452253c1
SHA2562ed4860804aa679a84e1fff9445c78da726e24b0e17141e7e3b5f3b956e6a5e2
SHA51295f46fa75911e407d69b573d54a266445d6a874e60343f1e8d10af693c92e719bc3b84978fe8dd6aef25e71b6512b2b618ed0dda0dee9cdb4d08513cff90e4c9
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB