Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13/02/2024, 17:27
General
-
Target
2024-02-13_12e2d1c2de65f1a66db9a994bbc11073_cryptolocker.exe
-
Size
100KB
-
MD5
12e2d1c2de65f1a66db9a994bbc11073
-
SHA1
744fe16869010e5f75597d50a0dcfaf1032ef6df
-
SHA256
9fce5ed461e08244f19d0218dd19aa1fa606a32fe4ec9061113e4f4fa2d2a591
-
SHA512
6e02e9c28a0a8a7093bbccd2853eb32959fc971ca0851ed771495d40304b325ee5871dc28d79f78ccc2f765dfe1edb7b75e4710281f6661667f6b27cdd05fc1b
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNu5tZ:i5nkFGMOtEvwDpjNbwQEIikgNyZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_12e2d1c2de65f1a66db9a994bbc11073_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_12e2d1c2de65f1a66db9a994bbc11073_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5697c7d96ecb85b8dcbd4767065768926
SHA1e38d11298a1cb4c578b97e40d864cd0852ffbb16
SHA256f4042b15324d3210d45033e453b6ff139fc69f106c3a0c6d62169fce4118e0f0
SHA512b1d03dd8d552e32384b31670a28197ef8998d9e7b020494da3a5ed0b03adbe5130c038cc1aa227300ffa06329674363de383ae165d132e4b760d9fcad2ebdd4f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB