Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/01/2024, 13:15
General
-
Target
2024-01-18_a3b97cd6fc55f113b91d928ee7fe58f3_cryptolocker.exe
-
Size
88KB
-
MD5
a3b97cd6fc55f113b91d928ee7fe58f3
-
SHA1
0eac49cd880f0a908ec7a9f0c263e8ca83fc50ca
-
SHA256
007f0363b4f690802952a294790ac215d99cc77b7b27f38b9120983b60fe602e
-
SHA512
5d2480ab3333498d53a5817d2eb4a7250b8cb2e005a826ffcfbe2f4000a50f3bc7d7b44d56f53fe8727fd52d4b416b32517e09f9db4458f3ae303dd2a5b5f742
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKazNcCJgW:xj+VGMOtEvwDpjubwQEI8UtzNcsH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_a3b97cd6fc55f113b91d928ee7fe58f3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_a3b97cd6fc55f113b91d928ee7fe58f3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5072a5378185dec46d1e0d3630f9dce15
SHA1d5a4e437d3c08a98c5794fd6b3438f9429a20398
SHA2563fce3b0e3779bbb2fc18bba643f0bda1530de4aabf9e52e32f61c984376b49c9
SHA512fed7a70a330b31ef188c319162f301b345799a47166b6c00b3ebfe2e9d984e441c614efef1f4741bda94db142907ce2ab929973c43404a1b29e9d6ec449ec273
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB