Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/01/2024, 11:31
General
-
Target
2024-01-25_a6a2d62419799b40130616ff394bef27_cryptolocker.exe
-
Size
38KB
-
MD5
a6a2d62419799b40130616ff394bef27
-
SHA1
7a8e5a8ed11574622868d04b026013f50d453699
-
SHA256
6b6e7a8974ec99f6ef37f1b33715764f473aa332bef160e2fa2cfe30561e031c
-
SHA512
c66b8372a58cb7a72ded68e57f3c49654e42ebf9302aa5522df00793e9d3cb2c1cbc3f1d3ddc2c51abd4223b1f2987c38fb8a07dc7b7b4ed584d51a9e31ca302
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRj:m5nkFNMOtEvwDpjG8hhXx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_a6a2d62419799b40130616ff394bef27_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_a6a2d62419799b40130616ff394bef27_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5dd0fefd3440da970d5ff6aaf75cbfcac
SHA1d95096f169d103da598e049579a81b743ee19577
SHA25606552004bf89ff885c8d2e314897446184e193c915b03938b73849ca27a1cabf
SHA512daeee1d5033485a41f2ab88b7b1c70cd4efa56417961618f1647e69e8e4204d0390b085d37c96106ae1b95daee570b0769f44dc4969ae19b7ce78741994889e5
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB