Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03/06/2024, 09:46
General
-
Target
2024-06-03_f7a9902bdec679b2eff6ec5cba5a44dd_cryptolocker.exe
-
Size
72KB
-
MD5
f7a9902bdec679b2eff6ec5cba5a44dd
-
SHA1
f63e555b5d5edf7fab0f2696f64e425f6fbee378
-
SHA256
53c26278341d7a52e4263e7f8b5e94e2e422b513e709e0ee1bdc8544b0a34a75
-
SHA512
d92a6a5606abad139bc97aef454f24c29967839b8a9c52c347cf2615c4ac16b0e016805756089aab63829d8f36a2c119e37140ca97385397e81758c65d8c475b
-
SSDEEP
1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs97x3:C4Q2c94OtEvwDpj4H8zk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_f7a9902bdec679b2eff6ec5cba5a44dd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f7a9902bdec679b2eff6ec5cba5a44dd_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5998e7fb6a2228e042f6d04732f9f5ecd
SHA19abc7a5713411a27dc2d4c28ee6e86df7fe32c63
SHA2562514c7df3231765ac232b9b9165e5582d726d58ad3dd1098412ea719bc472ae0
SHA512438c6059b8337dcc7cb64c77624ecd37f22834e5c27d7d12e72d9959779efde531de9e8906995b4371ea30a541ca5c5f144e5c75267e66cbfe993f43e96174db
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB