Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-01-2024 21:29
General
-
Target
2024-01-27_5326cfaf56f81b60a614a571b1c84021_cryptolocker.exe
-
Size
38KB
-
MD5
5326cfaf56f81b60a614a571b1c84021
-
SHA1
1dfeb92d2eb44c8dcdc2302af12559e821106719
-
SHA256
188b52ea8a9c2bd369a9cda18589d7a57e9fee910ab4699a6c7a2e26d25c7368
-
SHA512
d4d290dc35b9669e0491b94825c75d0b8f72255973e4bb2e9e242f6f3b96754f374e78cde9642a31f3db402a87404c9727ecca1ad49b6f182c633c3cebd54dc4
-
SSDEEP
384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOOA:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMxU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_5326cfaf56f81b60a614a571b1c84021_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_5326cfaf56f81b60a614a571b1c84021_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5b6f7c35131131ed67b14d1d4374da1b9
SHA167ac0a776c25643a74fc932c53191f4e5b51c9a8
SHA25691af65526b76d9376a2afaf4a4462a9125c79c8445ca5db154e03f30f3743f10
SHA512c39440be86dbc9064735b5a24313532f2c77cc85900e7324f6e45bff681bd3a353606c572e669ac38c54d387d74b878091608f436bfb0248174a3e06ecd7c463
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB