Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27/05/2024, 05:43
General
-
Target
2024-05-27_e0297538ca3f1b3e655d762a70905021_cryptolocker.exe
-
Size
52KB
-
MD5
e0297538ca3f1b3e655d762a70905021
-
SHA1
16edf8d1f9a3339e4ebd4bb013f82de43ecdff5c
-
SHA256
66460d5d817fc91e872ffc85e4503f9d722b26e1715e9c29d55c4e247c5fa556
-
SHA512
a9256816a92ea02fe7d7828473e4e1a64e430b4ddff08d20439a0ddf57c900c53a7ef597556611e24d66a555390708d040dc4ff83c764d3fe82a44712f9366d8
-
SSDEEP
768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtO4:bODOw9acifAoc+vr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_e0297538ca3f1b3e655d762a70905021_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_e0297538ca3f1b3e655d762a70905021_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD582e5099ef1b5c7d0a4e9735c019c38ab
SHA1e2507ff196830d861f3b1c6a8b94e67130b25cf0
SHA2566a9ceb861367f1e86ece1c7912ed7160153ab3ed79a7d33f9d4f87350d327228
SHA51238f596f3e0cefa451631bf1ca23664c5c8253ae194ab356bbf308af31c8f378bcd550280f102fed2dfe86e3e9dbafed95bf38d7d5f8c6d83162ed637164978f0
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB