Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14-02-2024 03:43
General
-
Target
2024-02-14_12ac2cf30a52fa84c87a245cc38d29f2_cryptolocker.exe
-
Size
47KB
-
MD5
12ac2cf30a52fa84c87a245cc38d29f2
-
SHA1
bd4a2a0e362a69ef7292e4ca80e9511261411b5f
-
SHA256
291f58a5c7294fdc13ac906aa31a98703012855e53272b5b3856354ea032a29e
-
SHA512
62100db873c85885a992ad039bfc7f36fe5f930c00883c459a8f6d58d426390c3edafba62344e17c74a5ac34dc06c4e080747cf4f4cc8742bfad33fdce04fd91
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvgpnuQ31:6j+1NMOtEvwDpjr8hgpuQ31
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_12ac2cf30a52fa84c87a245cc38d29f2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_12ac2cf30a52fa84c87a245cc38d29f2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD56acc6c5ed91764559df9d268e5c665fb
SHA17e48e08cfe045888d4037373aa3516d45e97d14e
SHA256bb0715cd86cbb781ae975c8167d4cff2916e40d4b3e0d3f48f3499f585d1a98c
SHA512d5996b45c615676059b7ee28210f47f8eca97b598a3e72b7be2c04ffb3f526328e96118a58d1884828b2ee1259f757181d48e90cbf0051ea3c95a5561ff7c592
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB