Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 06:22
General
-
Target
2024-02-14_01aa5d93242d04cc2e39bddeba7c6bd2_cryptolocker.exe
-
Size
59KB
-
MD5
01aa5d93242d04cc2e39bddeba7c6bd2
-
SHA1
9b866bf04947a407b07865c5a0b428cfbb4f5232
-
SHA256
dc663d45f006acb9007c4295bde11021b7922a5e7069726fc1c75fe6a2c9d147
-
SHA512
dc8ab6e537cb695e9246327a6c98adf08c50523fb604961eda733df5fadf56ddf49e05d7a42b22b7e0124edda46ac6488dd3f46368beefc6de6bbed11171fe1a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGE/:6j+1NMOtEvwDpjr8ox8UDE/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_01aa5d93242d04cc2e39bddeba7c6bd2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_01aa5d93242d04cc2e39bddeba7c6bd2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5817b5e4e8a54a5db7efafdcf9e17af1b
SHA12c8c353fd4e3e57f89eabc77ced9414d4dbb246d
SHA256ccabef2f3a2eafb808c7af9a9d71d21a603611cf2ec45e3755df356ab9de4318
SHA51251d38f0503c85d277365de8d3423b7470baff44b89294325c2107cfe5a544dc9609bc230dd6adf51b7468b35026525d753dadf101511363c5c9d7f758ec9316c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB