Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/02/2024, 20:29
General
-
Target
2024-02-11_42e65f3b467f455eea8d170fd7e6f126_cryptolocker.exe
-
Size
48KB
-
MD5
42e65f3b467f455eea8d170fd7e6f126
-
SHA1
aa7d9b045b2f67442055d8bd990e3293a16a5161
-
SHA256
dad115518b6bc8751e5ae275176e6ac2496b3c719980593fea7bb4b7b4247ce7
-
SHA512
e87a17109121c4b539298f2d4849263ba0d5fd7a6968742091643be0ce29096f7a33af8c323d0fa2b4b39f3d3c121f96e48b7816c2485114527c88a66890ca78
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvgpnuQ3SzjL:6j+1NMOtEvwDpjr8hgpuQ3+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_42e65f3b467f455eea8d170fd7e6f126_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_42e65f3b467f455eea8d170fd7e6f126_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD578131e6adf45e9f3865ff07c03a4ac08
SHA1f0fdb7c54719e9dbfa136607f98646e9afae50c0
SHA2560d9b47b4e77b59f15da5bd4b093764f646b4024bd560a398bfcf7562262bebce
SHA5124b9aa077235dc9fe30642607fbf56b943fef1b8724e0ed59c656c16c57cb554a4598164c2ec608c7448da9433c4d163d43954a09f0901b7a17492ad2e0f5ee75
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB