Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
04-05-2024 21:28
General
-
Target
2024-05-04_dd2a1dcbff58007aee22d048bb45cd85_cryptolocker.exe
-
Size
52KB
-
MD5
dd2a1dcbff58007aee22d048bb45cd85
-
SHA1
1966fffb70347809f0e397bd6d423211dcd3305c
-
SHA256
2286719e57cf7c94fa8e64245ef9e55c69c9b908a52aa331d9e782ca03d9b9e8
-
SHA512
792d60431fb2e8e971da96278771a3c9f2469b3de57fab4fb77b1669c871c6eab64524beacbab0be2c366e2a73b3c9cee7d7904e2f52f79f6c4759d3a1a32bdc
-
SSDEEP
768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOXa:bODOw9acifAoc+v8a
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_dd2a1dcbff58007aee22d048bb45cd85_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_dd2a1dcbff58007aee22d048bb45cd85_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD59c0253f10cd25b0dbe59373b49c8c656
SHA1af27bd9c1d4791cef9605811674a22cc81cf1779
SHA256e30cadd5e7fdf3c50d9f6e2af66bbd8e57ebfdd8ec63482d9bf95b4f07f721ae
SHA5124495af7e2678df62e49eda1439e0f91bfb32cb56229eb4de891628ff9676b5ebd247d3247cac92239b8281bd7d19869973a0df2209f328dc64e51e1206ec1157
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB