Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20/02/2024, 03:22
General
-
Target
2024-02-20_026f18a90b438823c05499ca0c0c715e_cryptolocker.exe
-
Size
101KB
-
MD5
026f18a90b438823c05499ca0c0c715e
-
SHA1
c0576656d3009704b580cdb1b42aade68fd82227
-
SHA256
5233c7454198a500290e210cd077f7f06be1229197715116e51b2765a46f42fd
-
SHA512
093d777b4520f7c2afc75066d565f66d31ca10dfd69728558c45f61dbafd3e125ca042bad67c3dd7f27d55a05cded6b4946db14d5b44263855e6947277c65039
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2NMO:xj+VGMOtEvwDpjubwQEIiVmkxv/9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_026f18a90b438823c05499ca0c0c715e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_026f18a90b438823c05499ca0c0c715e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD505689eaf43e146620efc69d63e3eb754
SHA1424e6cfeaf6a2463ed691d2a2fd18689338e4f7c
SHA256c2f8e72d698dab70e14acfb285ccd66bfc2e5ff54a5ee53d6c7e0fef6ace2e4a
SHA5129bd926c72e4bc3e5ff60dcbc3c5128a6f0bc3e83ef47e2e7733bce4473f311af87bcc67a3b66745a1bb5dcf7ec6e72e943d4ee6784649e8e08fee98c83bbaf1a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB