Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
02/02/2024, 19:35
General
-
Target
2024-02-02_8b36cd4989b778bd268a304ccb5df259_cryptolocker.exe
-
Size
76KB
-
MD5
8b36cd4989b778bd268a304ccb5df259
-
SHA1
8424cead9c840675788bb776f9557b15a047ecf5
-
SHA256
612f5fa0e12c998b4168b05bccae6a67d80fe3f85daa45b3b406919282948265
-
SHA512
2b3eebc12f403ef02c3f7e7391af4819fa4d0785ec1c56ba8ef218918caecfb6606754c98cbd91612450593213e111a261033ebd67f2bfe4d40210ca8b418741
-
SSDEEP
1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KEWTeLO:ZVxkGOtEvwDpjcaxU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-02_8b36cd4989b778bd268a304ccb5df259_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-02_8b36cd4989b778bd268a304ccb5df259_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5acba576412f9065f992f35c147352656
SHA14e6c2880cffe1468b4f642ddddee96447935fc27
SHA256c48ab33412b82ad20e6fbceb390c6481ee961f497f1dc8f6abe9556bdd15226b
SHA512ed85e74735d7976a92e1beddf10bd37d53fc5010b3040a3e93cf24a9dbfcef86607e21036cd5560d8325b9ebb5214ee3e5c37df7a547beca1d43a899f226ca19
-
Filesize
24KB
-
Filesize
12KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB