Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/06/2024, 23:37
General
-
Target
2024-06-12_d3792ed7d6303d1a90eea5ff26030031_cryptolocker.exe
-
Size
53KB
-
MD5
d3792ed7d6303d1a90eea5ff26030031
-
SHA1
219457a7bc889ed8f9e8f0babfc17462a1e91722
-
SHA256
e6d12818cb38c8fdb271f029d821348bb65a09995f01be6cfb766919558c12e8
-
SHA512
90a2a65d4c06e81733ee9a2d4b928c39bf4d6d7452849ff01948075ea35bdc772851a6a940eaec843a7d110daeb4ca1f8edacfd48a480f8c28e74365ad221bcd
-
SSDEEP
768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOT1:bODOw9acifAoc+vi1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_d3792ed7d6303d1a90eea5ff26030031_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_d3792ed7d6303d1a90eea5ff26030031_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD53eb9da470d0c91555f1b1c10ec991450
SHA1e602eb06bb9b0732a438fd4e5c7b3530d020fd0c
SHA2567cc208826ff4fc449d2095ab11d4a78e8c4cb5099f3288a227c981f650e15971
SHA51214f580f08dfe644118bb80dcd43205e0562f5339002d6f141303df81f2cac4ab2a262d45f50f2cb6b90dda79d9d020b3c3ba080bc7433c8f3ab25f462bb4d154
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB