Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20/02/2024, 16:41
General
-
Target
2024-02-20_4a22f436b886b68a177230cd3c9c88df_cryptolocker.exe
-
Size
86KB
-
MD5
4a22f436b886b68a177230cd3c9c88df
-
SHA1
79c937500f708f73877b86ad2d582aa33abbbecf
-
SHA256
1f0bb7baa46d372378cdc2ce5bf68eb92c8e3846aed02bea04edffe9f85ac8cf
-
SHA512
08734911dc54c265c7915c426a4aefed58ec57a008eca1e82f8ababda1a4cf04d49b0cb5700198b9e6abda293e4096c894c6335596378cd6017610695bd5b7c5
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvAcl:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8Acl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_4a22f436b886b68a177230cd3c9c88df_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_4a22f436b886b68a177230cd3c9c88df_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD55f04b0b1faefab75ceb5f9b00da5ac4c
SHA1a69102e0c0fa8701499e0ce257f86fcb0456d911
SHA256f96ee2978fd69ea0c6e913017ccd27fed54610c28a05e2517fb0f0a6c30b08f5
SHA5128c25f757b95e13aa018c1d83527d2ac0b778cb862854d9a8da4deddd9b609177c4c08e8480a23ca1badb133e8af635b035f6c93c5c5b0d32155195dd9c866f07
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB