Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24-01-2024 12:33
General
-
Target
2024-01-24_aedead16ce218cd26d0d5884f2dfcaab_cryptolocker.exe
-
Size
57KB
-
MD5
aedead16ce218cd26d0d5884f2dfcaab
-
SHA1
44037aad39cbabab3d815150021b927b78d6f2ce
-
SHA256
a97d1ce3f844cc2d1a4e9c7984e82a3e7ecb544533b3485f603dc982133c1160
-
SHA512
a277281d198b297311f31de58e7aec5a7269fea530d367a23e3f0e3169019fb7f9442bed1462072e179f4132b512275252ad6582c50a1d8ed7cbb4d737d123d0
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7GoFwQ:xj+VGMOtEvwDpjubEgywQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_aedead16ce218cd26d0d5884f2dfcaab_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_aedead16ce218cd26d0d5884f2dfcaab_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5b8421ef6ddbe21ae5e84a390cfb4f7cd
SHA10451de6e42d49015021553e9baf50aa6119b1523
SHA25636a6402e5e6ff0c44ad21ad6fc5f0ed495ad5c5c235295feecbff0b65c5c0e28
SHA5124c9b2ec2a5f7fe5ece291dcf4fb32f2445ea2ecb6546b4529627be6aeb802972bcacad2035f9c49568aa911c9e0dc739e0a217116e349fe19346c67716212244
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB