Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20/02/2024, 00:32
General
-
Target
2024-02-20_4a486fc785c16d66b0c3be0e335bf9b6_cryptolocker.exe
-
Size
64KB
-
MD5
4a486fc785c16d66b0c3be0e335bf9b6
-
SHA1
fc1e49713dcd90f70b0bc330498d1f3b112701b3
-
SHA256
7e2599d85a451b0dcd82b728aa59159051db78acddc9a3d83ca7c3b551a011f2
-
SHA512
27b497e43828b1d52c9a82d31434950fb1577b2df25ca204f81632a759fd27e5372f329dd10486fea178ef042a5c9706b932d14033bf7d5243c03bc53d73f591
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10Km9t6:6j+1NMOtEvwDpjr8ox8UDEy0KmS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_4a486fc785c16d66b0c3be0e335bf9b6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_4a486fc785c16d66b0c3be0e335bf9b6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5acd19f537009bb5cf53c7c71e9f816d8
SHA14ac712b51f58685411011f50d77793b8ec719958
SHA256f41829352ad69090d43e15971d7079c9d398c212cde3fc9703cd386b5f0767b6
SHA512a9143e243fad624e8d98f6c1185884f436d11a9ff2e38118ef4cacb0dff6dc4620fa06c3971a1c0c098ea6cd40db12e11d929c943fc075250b9bf8d6af2422ab
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB