Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 04:33
General
-
Target
2024-01-27_8ae5263fb4e9045a1397fabf3ab47317_cryptolocker.exe
-
Size
39KB
-
MD5
8ae5263fb4e9045a1397fabf3ab47317
-
SHA1
2fa1370cb8aa357df1ec859a80a8b72413fd7b40
-
SHA256
5645c3c88ff82ee0d753512f2d98807275e6e3168302435aeda0ba0316b94659
-
SHA512
99f6a7fafdde3201ec725d3704db422be25d2f2ef32edc53d40ec8014230e1a59dfb45f640eb0fa1fcffc04f1b69185db9f2f1b35f77da3b940b670c58b54122
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLtldJQBgb:i5nkFGMOtEvwDpjn/JQ4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_8ae5263fb4e9045a1397fabf3ab47317_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_8ae5263fb4e9045a1397fabf3ab47317_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5799ee92c8c440a9979a045c04cd6ab19
SHA1f6eb466fc5c93e2059da2919a00413344d64be26
SHA2560532f91d1441657f6bdc9e1faa4b597cd13a5ece651e1374c531332dd0449715
SHA5120d2faec2bbcc99301ef30a3ddc1efa8fe858f289a5b1d5cfafa88082f3848f30abb9f6e08e313406ee9b564f20be119d1b9c52668f7f04f38d5eaafad3579f66
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB