Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 23:23
General
-
Target
2024-01-26_6164040b0dd811854551554f8a0e2f33_cryptolocker.exe
-
Size
39KB
-
MD5
6164040b0dd811854551554f8a0e2f33
-
SHA1
8876d96fc65993bbd852caaa88819e550f0d8bf4
-
SHA256
0ce1d6959bc3a734dc1910a65f43aa789af61cf14d74bc816439464290798260
-
SHA512
c11d6d605e4ce4208daaabf1e849d3279283d6e33f2efab278bc8dfdb111d4cfe3a64595c04dd5c5e7973221f00eaffa8f7bd5ce8b2f6aa889e8159edb96c97a
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnHV:m5nkFNMOtEvwDpjG8hgpHV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_6164040b0dd811854551554f8a0e2f33_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_6164040b0dd811854551554f8a0e2f33_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD59269d234eade34a68af2dedf0c7012fd
SHA1224be9572fd15800a9adc6bc364e965c456b706f
SHA25698cbeddefe14510cc0ff2e5217ec0adb5b14f4ad8e9ba2448f8eb30d1ee00e75
SHA51203a7297d051f3a3e8f23c8887a10a2c19f25125d2e9cd6ac62000fdd9cdc80fccb491d873f3f8466cff762e377e0dd5c1046ffe473187ad981592dc2a15c2784
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB