Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
19/02/2024, 08:41
General
-
Target
2024-02-19_7f3c50c8a261fcc088dd0556fdca5b2c_cryptolocker.exe
-
Size
63KB
-
MD5
7f3c50c8a261fcc088dd0556fdca5b2c
-
SHA1
c4f6a2dc7c88a9d6b610159c27b71e0ffe580038
-
SHA256
145632f1de3030e9e10472035b501cd857a293bc08c224f119b20583904abefb
-
SHA512
6908727ecaa1402dbbdb55e95d55e1e0709d589576ef04473fdfd0cb444f089259a903da086acb64fbbae8ae0d8d848a65a129466b6232e95f87267db5cc28d9
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEMoj:6j+1NMOtEvwDpjr8ox8UDEhj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_7f3c50c8a261fcc088dd0556fdca5b2c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_7f3c50c8a261fcc088dd0556fdca5b2c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5014bb5a284f1a954aafb8b71265d2a8f
SHA1c35afe81aa1076a110b7b84c4de53a6c1b834b8b
SHA2565bf94b0ecc58f5c1c2263d1055224e11dd4465506c8900df472e102e658a2968
SHA51266169ee76a63aeed2bb2f47d7a56b360e0204a55d668c280b6e264627ae47d70ba61ed54be0e77f66fbe72e13fe59ceb191108d36818a4feee1ce7fe75a497ff
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB