Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 08:24
General
-
Target
2024-01-28_1ba66a8e239ab75c87dcf4ce8dc7217c_cryptolocker.exe
-
Size
57KB
-
MD5
1ba66a8e239ab75c87dcf4ce8dc7217c
-
SHA1
6c83c9e121e7dc38286657be8c9430381c5c594e
-
SHA256
cafe6bc147468b2b0a968eddf61890d82e042cc432c2381f242163f4f1cb302f
-
SHA512
90ba26e2a0d8c3e0cf415e09caa6d5f7d7d6eb1f4e45a4529f36bc5139650c581af45d46bb03bda581d7c572f5ee4085ce28634f39d5db1a03ae8e91d303b578
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7Goi20HVeDgvT:xj+VGMOtEvwDpjubEgV20t
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_1ba66a8e239ab75c87dcf4ce8dc7217c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_1ba66a8e239ab75c87dcf4ce8dc7217c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5f946d8447ae171ef13d34618e826d3fa
SHA14eac8aa97bfd46318ea67794323a116fb5e257fc
SHA256026161821ae2bf7f2b2ab69a8db2f4a484be36cbba80bb391084ab22c9eb8a52
SHA512a83295f0d7eee9dcf40a0fdee8b6d7ee57368c3a90cf90b3fe0174a0ed78e54a47b996d69f9ff9d725e45fbbac81f728a69bbf38564f390bc87787a0e216cf62
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB