Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
17/05/2024, 03:33
General
-
Target
2024-05-17_8b4389fcd39e6bcb128816fc847bd20f_cryptolocker.exe
-
Size
80KB
-
MD5
8b4389fcd39e6bcb128816fc847bd20f
-
SHA1
b895eafe43ea201cc55362762cc1ec8659fca421
-
SHA256
d0a7f6b75303f8874947440ca86fb91989165bb7b604f1df068e68b6be9bcba4
-
SHA512
87607a1404e799c6ed7f1efbc21e7cc0306734097bbccef27ecec25104a26bdb9592ccd59961df3f811705d6de2a37e719e94592aae00a9b360a0928417c4d5b
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7QM:zCsanOtEvwDpjY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_8b4389fcd39e6bcb128816fc847bd20f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_8b4389fcd39e6bcb128816fc847bd20f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD55b8f4711fb74bb03769fda9d8eba0d3a
SHA18431761704afe60531a952bd8cb352349722399d
SHA256c966f316715653dcb964d3aec4425a3bddd78d3ba98b6f1d575248f97ea992c3
SHA5128e0cbfc9655fc70aec9ddea733f6058b9998b626eced419e57b3cab12409e437712451f927264f2a5b826d8ba73c72d7550e81aabf724b1a6941b91b7f2ff491
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB