Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 17:26
General
-
Target
2024-01-27_4e0f633c2076a6bc8125e96d6f2351d3_cryptolocker.exe
-
Size
52KB
-
MD5
4e0f633c2076a6bc8125e96d6f2351d3
-
SHA1
2577c61a91f716a6a3c1b15d83e554da3b7a229d
-
SHA256
f9d731e318434729cdfb5c173afb1f8a6c8f0fc377fae9838f247d7ee3efd1a3
-
SHA512
56ac5a9e8fee2f85e6e4f2ef1079260255322525b97fe1f4e32b7cad0b3f953ed0eee66a9b15406983fc06ee63f24c9e50ab03d44ba61b08c6e3ba21d5a09bd7
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7A:6j+1NMOtEvwDpjr8oxEq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_4e0f633c2076a6bc8125e96d6f2351d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_4e0f633c2076a6bc8125e96d6f2351d3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD57f3360fda38124d214d906f3547c93c1
SHA159da84f28bc6cc0fa2ab4bed4f0ccd45d2ea526f
SHA256d303e24f30c81e805cdd5bc354f601494e2bc1cc13457ffa175a7265bca8ca8c
SHA512330b6df41f074da9c53674ae87e355f43c34e803d1bed38740d10a818edc92ef36822299cae3790b98a4cb08d34d15b02c01e97f3e6caa7f8f97c9decbe3c261
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB