Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24-01-2024 23:29
General
-
Target
2024-01-24_d4d6e3320c1fd1cd026f4cb672255c25_cryptolocker.exe
-
Size
53KB
-
MD5
d4d6e3320c1fd1cd026f4cb672255c25
-
SHA1
ae2098d6b648969b2196337f85de90a91006f649
-
SHA256
25777c899d95a49fc95cc552dbb85e0bb20930ef4f8234843ea5778ecc4f325c
-
SHA512
0c9a46a8101254c3b7c421cc7a9fb4d72f7d1bc5fd237cface3dd096b0a4edefd9a76a7319ae24ee03225d6955e421dac3c00c853cedcfb1963141ee42180b4b
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7W8:6j+1NMOtEvwDpjr8oxE/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_d4d6e3320c1fd1cd026f4cb672255c25_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_d4d6e3320c1fd1cd026f4cb672255c25_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5b5265702939a815494b61724c8fcf648
SHA10c5ad2c5bda0c0ab5dc2e0cedfd28eab10ac5857
SHA256eb8f55980a4d5412bbe41eeab9302d0172fbabb0c54d3403b0da8b2c9e361085
SHA5120370bf03e9bd92ed80bc8d22678f6d0d7d2e93734ea740d5cf31840493d36d12648e3869e6b757bad1031e399ed78e710b31594ac84ffc178a3a5e2b65ece5d3
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB