Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
12/05/2024, 10:44
General
-
Target
2024-05-12_124634c90136aacf188412a14aab3d2f_cryptolocker.exe
-
Size
70KB
-
MD5
124634c90136aacf188412a14aab3d2f
-
SHA1
8c4527094c55641dc75fb5a34d6204b52ff90059
-
SHA256
e9e9d61ed126807a7e9ee309da3cf21f9f3d199a5d06aa9c583d757fd1249764
-
SHA512
6808bec40e77b47a8a430e965ada3af45495e33e5d5c506e33e4eaf487eea295d441c8b3b5388c092faa6ae1e7e0e7ca09b8fbde9aa12f222d2e1390dd5f2fc8
-
SSDEEP
1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9T:C4Q2c94OtEvwDpj4H8z2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_124634c90136aacf188412a14aab3d2f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_124634c90136aacf188412a14aab3d2f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD528198695635bf5b7916aaa3191977ce3
SHA156edf3f63ee09c0e62d14f99a6afbc7da1e1bdf9
SHA2568d3e665dc83e039d384b85b04f6855ea9511016758f58c6b3feb9991bce6e813
SHA512d98e89b57685589a3713f49b622ffc0d912c6cf29ca6c78bd16670ea8e9b36355d8903490c5100b0c9abc83f8e14191e26a8dcc450e54a15d44430b4599a053a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB