Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 14:04
General
-
Target
2024-02-14_f2859eed779c80fd0ac2eea8b6b5e47d_cryptolocker.exe
-
Size
38KB
-
MD5
f2859eed779c80fd0ac2eea8b6b5e47d
-
SHA1
3cd6c48557daf3ea2c5ed3d5e7082817fcc21a2e
-
SHA256
63c4d93bc18c8a5a9f2f02a4bd5787e20f78369df80e8a04d142b053b3666cc2
-
SHA512
2d8a37bff0f2e7ca506f59e61eb6685b0c73a3f3d440c51c2cfa64e15ea7e5db87aeda82ca9a7176566ffa2e5b17f11dbb38a4433152616978c5797462c7e6d4
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yY8:i5nkFGMOtEvwDpjR+viH8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_f2859eed779c80fd0ac2eea8b6b5e47d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_f2859eed779c80fd0ac2eea8b6b5e47d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5dcb7f099c1436e9be8fdb4146afc1a01
SHA1973fcda976ef3fbcc44d4e1a73a30c71dc5e6351
SHA25662fb9af387ab2437d67bfb80b40cc8bef0b204b129a77a45e45fbf8300671e09
SHA5122f49f8c449db8ead1eb30d0af9882d12291f780fdf1792a2aee2a4f26f417fc1a6a0df48a26d28253c96b7872617dc162cb346e73c2dfc69464ac90421b541b1
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB