Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
27/01/2024, 04:38
General
-
Target
2024-01-27_cb0838c8e176913b5144f1611232c433_cryptolocker.exe
-
Size
47KB
-
MD5
cb0838c8e176913b5144f1611232c433
-
SHA1
7a47a521a6cdbf3ceffd8104d324499ef1956f94
-
SHA256
c47dbbe3e5233904a480ee9592f077cdf9712a30e450fd3f9b275c1e592a321d
-
SHA512
b062242dd64c6760c37d66cd8eafd66881c1658133102813e09f0f1a68fdad8296c2efc547242730e2a6c007e6a451d4839ffd1d1a01a760f6f8e972f8c9ae00
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rzhwaq:xj+VGMOtEvwDpjy+Tq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_cb0838c8e176913b5144f1611232c433_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_cb0838c8e176913b5144f1611232c433_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD55696dd7591c15dd873fd3de91048ec5c
SHA1b983dba7af7f1616eb7ac7147d61d8da67803e75
SHA256ee3fac6d81b2eb7550ba850e83c64d3b768a4082733cb860af0e52f5a43174c9
SHA5127280523145c0b09a551458099fea6965d0c354c3dd253114e9758ae9813060b43a3dbf9989436455a920ed4496ce1d4335c70e746dd9bd787330259e90c47a58
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB