Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09-05-2024 14:46
General
-
Target
2024-05-09_81f294bec83d13ba4ddd822fb13e4e2e_cryptolocker.exe
-
Size
72KB
-
MD5
81f294bec83d13ba4ddd822fb13e4e2e
-
SHA1
85de66107ab8a7e028e952aaa3d2e105fabf002f
-
SHA256
47dd57afebbda0b8d76470d772db62d13619ccc0d197487a87e875bcaeb9da83
-
SHA512
16e822443c10b74adfca4450626d9cc8625bc5741d5c15f0ecb4d71c8af9e2dac558f94101792b2324f732910e418afadf11630b4aab159c3c3c606f4ac2e0d5
-
SSDEEP
1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs97:C4Q2c94OtEvwDpj4H8z+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_81f294bec83d13ba4ddd822fb13e4e2e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_81f294bec83d13ba4ddd822fb13e4e2e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD53d325eaddd8c38775bb2c883c7b52df8
SHA1269801b565e213e438a020a22d9e995c2456b453
SHA256d3db715a9adef72d9fe17becadf58803eeedcc3d95e3b59aeca81d8dc1fdd64e
SHA5120afe07624314e3a5306496ba43b73a6b7eea700b0914b5a686eedd2e844e1997ea557916e062ae80ae7eb1d814029ae149164d35e5dc2b10551027381b089067
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB