Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
28-05-2024 21:26
General
-
Target
2024-05-28_34b389317b0811065b83b5231bc7101c_cryptolocker.exe
-
Size
94KB
-
MD5
34b389317b0811065b83b5231bc7101c
-
SHA1
50a7696942641c7a9d90a4571d4caa240a127d55
-
SHA256
075d32ea39e8532d09a999608c8927c510872ee57761e5adb6c1737f54692280
-
SHA512
54e21dc784b6a9f690e407a2f7affbc83c8b604ea530e953ecb58b265c92d6dbddb47c597d88e58bd3458559c9e53632b3b2a4bdeb4cff29a79791133eba9c7d
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/kC:zCsanOtEvwDpjBN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_34b389317b0811065b83b5231bc7101c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_34b389317b0811065b83b5231bc7101c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5f96078302c5d86f6cc063805baf0a744
SHA1d09cd8b71fc5ffde4093c0d140984242654d681c
SHA2567ca6e776b02d5929695c95f18f07c4e60c6f714af94161e7252403dc229cd4b9
SHA51279cc661cf9c1353833a536127978f37219400abd4b63fce7428bec4394f31a745a5577377f422347f816a367a7d88cb96f55e9b7caebe8decdca281cd8458053
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB