Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/01/2024, 06:44
General
-
Target
2024-01-25_f984dedaa43c2ccbd1d6579961316d13_cryptolocker.exe
-
Size
38KB
-
MD5
f984dedaa43c2ccbd1d6579961316d13
-
SHA1
71210e2f04aa18430f0cd74abc44b432929232ad
-
SHA256
acb4dca0f31f3f464150ef5febd20e57c84b6e9cafcfcb125bcf2a3b283dba37
-
SHA512
d8b1ef43f62f95c0d73ec27fe1784ff61f119ad684c7ae8bf809523926e594d562c971210347f9743186f92f242244f04b167567e9a4ca97d3bf733d5d0b60af
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnGK:m5nkFNMOtEvwDpjG8hgpD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_f984dedaa43c2ccbd1d6579961316d13_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f984dedaa43c2ccbd1d6579961316d13_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD518a67b8f9f4a565650ef086cde850d08
SHA11084e4ae867585b98d4f7441310913d019cd4ab7
SHA2564671c1c193b3b0252ac05b9f6507baffd3351bfe931b6bbb53c88eee03317adf
SHA5120d67ece27bf249de4fe2ed364f201c5ec60f646eef4b566f32fabb05546ef499e108f27d140b5bc71c386033bfdaedaa097f09962fb001934d7c05e10bea92ac
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB