Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03/05/2024, 03:59
General
-
Target
2024-05-03_d6ba92b23696eab4eafc4e5625ec80fd_cryptolocker.exe
-
Size
83KB
-
MD5
d6ba92b23696eab4eafc4e5625ec80fd
-
SHA1
f1f64ec98de55f99a6da3d50ad0c252109cea7ad
-
SHA256
0fd3aba941010c729176a5401af85b89cb7319d57a09e15ccb2b4c8a095abd05
-
SHA512
487b04ab0c028264b9d40a3815c13abf7835a8f77eb88cf2917f9650e72e985b870b6e09d26f2308c9c9db9472b1ae863c25c23bb85777ff67d4bfbecfdc0c81
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kyJS1m:zCsanOtEvwDpjw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-03_d6ba92b23696eab4eafc4e5625ec80fd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-03_d6ba92b23696eab4eafc4e5625ec80fd_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD53171e2987267e4e5a6079726b37fc127
SHA1979c40d55a87494db494001a2297bf8e3be38dd0
SHA256c5506b49ac315ce230b4ae24ab541424152cb2b0b52eb474e59abf3cabe6294b
SHA512901b32e1f3f13e6668909b6b5e5287e2ed604b7fcfb90afcd91c816a82a67f6ea1ae077ce4fe0cf1c588e4bd6e195bd0781c9b9ef9db89a21df4fc377b57b02a
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB