Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 19:27
General
-
Target
2024-01-26_3f7129742109d00ff00a34d93c44891b_cryptolocker.exe
-
Size
43KB
-
MD5
3f7129742109d00ff00a34d93c44891b
-
SHA1
11b30f46306d26b8aff31ab51577fc0fa5d52cdc
-
SHA256
0b931a2d1a1bef04c214b57f40b607bfbc288c4f8b393d36a1929e6532b5413d
-
SHA512
400c5fe7628179c4323dc8cca1e659849890695d035eddd4f85ce894c187761426fb05ce2c5aa551acf0e2ba904244db33342930b91b19b6a4e7405b32851a6d
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhbCi44vRF:6j+1NMOtEvwDpjr8dx4GF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_3f7129742109d00ff00a34d93c44891b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_3f7129742109d00ff00a34d93c44891b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5bfbc5107c40970e9387617563509838c
SHA1365c72b3885062cf8b12ad605a8520b39cc9b08d
SHA256200fb03864df03e07072334c70cb2b08e061ca54bcb749a555f6a2df081e8dd0
SHA51221bda8bc52becf0b61ceedc65537393f95fedaaec7dbe2f50e527bf4d6eb76b891686b3e13becb4a6958b15657f5732aafc8c75f9204c4b238f22f5b60b083b2
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB