Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 07:31
General
-
Target
2024-02-14_35df66a4ff27d12ae01f100ac1f063dd_cryptolocker.exe
-
Size
55KB
-
MD5
35df66a4ff27d12ae01f100ac1f063dd
-
SHA1
500c10f133d0066553d971bbcd89c286cc3018e3
-
SHA256
72298c963aa10fe43f2d677f7621366d92f0fb76d79967aee134511c79cbcd0a
-
SHA512
ec5f6537a6606a346f8161a01e9b41c9d8917856ac50a1913c16238d73e5b3a39fe5896fd4704f146b1b44758c1cbdab00d77c5f9fe04d7ed00145e310bbf9ff
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7Wwfeh:6j+1NMOtEvwDpjr8oxEqh
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_35df66a4ff27d12ae01f100ac1f063dd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_35df66a4ff27d12ae01f100ac1f063dd_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD50543d0b72a1fbda61623bc8709d1aa9a
SHA1df9a33e8bf18b0b8e40ce5173c0362d83def7872
SHA256aedcd4869957e61af45b609aa7142ed563881bf8d7029f08c421cdbedfe33732
SHA5128cb3a9b419ffec119bd78003e42e1b0c08d1065e609fc4926ff668f6e32b651275ed8c8a9ccca361317d17fc12f7eb03d95750f5df88b9226f7dac135ef7cd69
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB