Analysis
-
max time kernel
175s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 13:03
General
-
Target
2024-02-14_dad98a30615a3602dabc7ef9ca298fac_cryptolocker.exe
-
Size
63KB
-
MD5
dad98a30615a3602dabc7ef9ca298fac
-
SHA1
a6dcb9735e231ad852f34c31b1104e5e27e7b539
-
SHA256
9487ab705d4e0a9dfe75b7b7935a3c8dd2364be8165df24632d03888e2110d88
-
SHA512
b5abf42dffe59bbaac770a5137d56614faf0b5bcef3c63f6a2f680c3cd8d1dd30f0a4d84e9ceb17a546c4fa21951a715dd688120d1069146529886c4b50c2e29
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10KmQ0f:6j+1NMOtEvwDpjr8ox8UDEy0KmQ0f
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_dad98a30615a3602dabc7ef9ca298fac_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_dad98a30615a3602dabc7ef9ca298fac_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5f7dcbf148dd52aaf0ea7156984cbcd77
SHA19f8bc482774b9641dd9099940c8ae962e8bd6c39
SHA256eec90498244c2fc63f3c5ee36633cec86400d5968639ba2d2fa77fa2a0054cb5
SHA512678c960e51f99ec279cdd8f1bf39ca10efac465fbbd341dc2b9f8bdef9add767ea0c7d87f17a1f787d87f690d0eb4924de08da28cdca9707178a5f2b0d09a76f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB