Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03/02/2024, 05:25
General
-
Target
2024-02-03_21b82ce5edb37aede9146e86fff237ec_cryptolocker.exe
-
Size
47KB
-
MD5
21b82ce5edb37aede9146e86fff237ec
-
SHA1
8057a161b18baa67bbb0ab405e8bd6b0b30948a2
-
SHA256
7b799e79b1fcf97d48a8c230fb665bd21fee4a56344fc33db8ba2ededcbbcd79
-
SHA512
1c0465293a0a4b7eb8c3ff94b379e6d871d6fe93f792b7277e1cd2871c10124868ae7f52c89f246f94fc357c0eaa3467d5bf3bd1e306b7c1d5c58e2fbae3951b
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rzhwa6n:xj+VGMOtEvwDpjy+TI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_21b82ce5edb37aede9146e86fff237ec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_21b82ce5edb37aede9146e86fff237ec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD545352cd769df7f10471f8941ccc2032d
SHA19842412a48683e54a8cfa723b7421f714ddf73b8
SHA2568be12ff6593c56c76f777bb25220c629229af4d39266a1c0f44d87f5dee6c02e
SHA51211213f6f99b4b6957f1bca9a06e804473f1b86507cd4ee75cccf3ee32645fc1578ed60f0a392bf613c419babcc8c3e1113afe5a0f386ced301285269a44d9ad7
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB