Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/05/2024, 19:51
General
-
Target
2024-05-27_e271ca825376dd875347b62371875c44_cryptolocker.exe
-
Size
95KB
-
MD5
e271ca825376dd875347b62371875c44
-
SHA1
deb1009df776bd6de8e615027093cc41de8d0074
-
SHA256
04ca8570e334295ace920b4d3d054daa360f58e409463aa7cefcedd9f55d0349
-
SHA512
dabf795e1e1bffeb8ab839f443ff0127a76ceef664608145a9733ea28abd8bdc4497a5e405a66de8a1973ab5ed997d09d455340c9a5689dbbc0696a90f466f15
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/kt:zCsanOtEvwDpjBa
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_e271ca825376dd875347b62371875c44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_e271ca825376dd875347b62371875c44_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD582588e886652d7d45f2ab17f823ccd5f
SHA1b7e32a73e51236d7074696670c09e9320609db9e
SHA2564156b99e198501d6fe3759fb0de4310cec0e6dd79510efa5ca380e89829df2e5
SHA5127f3ab19cc7cf50a09d5c6d0735cca0d36ed71b23ad0825fb3c2ba6b0be7984891ed148b509a8711aa3cace00c3e31dd7f17781f297e146094a53f70306253a75
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB