Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
24-01-2024 03:45
General
-
Target
2024-01-24_85e1cc28b1d4c37a8c2dae935a6865d0_cryptolocker.exe
-
Size
47KB
-
MD5
85e1cc28b1d4c37a8c2dae935a6865d0
-
SHA1
7ac2023e73659d261a3ab1b02751a3ec416fe419
-
SHA256
b6aadb78b27b1c45063bf4c3f4c1655da076478891963cd0187ef3b1e0aef589
-
SHA512
3cc9c7dd3403550a95bc89dea699d9484d3e8e679e4dfee02f5f9a079d8aa053f5518c25a4f0f2ec029c58c26a0ce45b05685a70a7beacccbb245a67ef96602d
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rzhwax:xj+VGMOtEvwDpjy+Tx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_85e1cc28b1d4c37a8c2dae935a6865d0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_85e1cc28b1d4c37a8c2dae935a6865d0_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5706c48e469922ca35bdd3ca43027fa78
SHA1b1e4f18f334fcc3532daabc849c64691744d652e
SHA256b3e4bc460ed15b642eec2d4b491a5e17ab84e2d5a1f212ece0fc9e8196aac468
SHA512b1aa959c5e261a1ad2391492c3a146b9cd3a576a4d62b1d6fd1c0f68971c243e9f7cabe891e787c0137337c8e078072c1f41d5b904f836638298a3dfd98a1aee
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB