Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/01/2024, 03:43
General
-
Target
2024-01-24_70dd89fc287e9b3f796b28747db8a7d8_cryptolocker.exe
-
Size
93KB
-
MD5
70dd89fc287e9b3f796b28747db8a7d8
-
SHA1
5c4d345a8db404355cc1e85bbb169e724d39b149
-
SHA256
fa9a54b439a976edeb0da1f46f017b8bb667de9dfd5b97bce6607b152b858688
-
SHA512
4c6cd3c10cb7d3b2aa413cf6b493eba2d7ca874e59cbfce671b7e77bc31ae75d9fe562142ce3c99cc81796088a3e3ede0aa54b29c788cd13a93bab9eb7a69ca6
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJkx:xj+VGMOtEvwDpjubwQEIiVmkU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_70dd89fc287e9b3f796b28747db8a7d8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_70dd89fc287e9b3f796b28747db8a7d8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD54d5d8ed1e1614328bbcc000c76aa15c4
SHA1d86e96b9faf1e88fc7e96e6ebef270c97aff1466
SHA256fcf406f17c276d337012957ea9887d62a520782f9447129be0a047df586a52dc
SHA5128ff264c157734cf53d11bae391266c93d1626aa9a3523b70e29e198d270898bf471bc87b5844189fbb94788004967911da9811d751a93dd078f2621fadeb9c3a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB