Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/02/2024, 12:48
General
-
Target
2024-02-11_605f90e03061419452d8544de86e7d00_cryptolocker.exe
-
Size
60KB
-
MD5
605f90e03061419452d8544de86e7d00
-
SHA1
a5d13e8c6a5dc0410acd8c9d8181dcbb07f8ed41
-
SHA256
41bc6aebe4aaa77dbef2ef8af7712d6d575538e92fe788cca615b0beb46b33d2
-
SHA512
2d38e247bee85384bb0da86b2f4dedb5116f25f0d4b259c7e5f6de72ece0250ddc5c545973f1a10aaa3cea74b5ef8a3b6d16b0d8d983cb5a3d15925c66a937a8
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMN:TCjsIOtEvwDpj5HE/OUHnSM2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_605f90e03061419452d8544de86e7d00_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_605f90e03061419452d8544de86e7d00_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b8a2ebec6323a78cdb292ed465caac82
SHA10d566eb6944e05ed34aef4eae7300aedde5ec6b3
SHA25660e2b8a5e26a19231dbee726334722c5d5dabe956f7772279b2b92b452b31be0
SHA5120695f2492a3055a52a3ffbc029fb67ace0dcbb46c77ef3849f105680c122c141501ea1aa9ec1a75662c31eb4fcfd0f7ec57b2fd6dd3ed15ab44d44853f1424be
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB