Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
21/02/2024, 16:57
General
-
Target
2024-02-21_eef8413904b4c88daa2f2b7f111ccc16_cryptolocker.exe
-
Size
85KB
-
MD5
eef8413904b4c88daa2f2b7f111ccc16
-
SHA1
728522976a3d6b6f6ef84f7e3e152aa9811d398f
-
SHA256
0bdc3f141382404a1a054fbb770cabe0e24148b9b2c02842d8eba9ba368af7ff
-
SHA512
5a4dd2e9771084ed660df7e92e1951e50594e9e94da04b29d115c5638f38ef545fcfc635f54c82f82ba52c06dd5217371ec0378ec62b2654674306fc74c76fa4
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvxpRZd:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8d
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_eef8413904b4c88daa2f2b7f111ccc16_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_eef8413904b4c88daa2f2b7f111ccc16_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5a3ac6830f6df858461386d574723e99e
SHA1850b2dabcdfbc2f4c6b3f70dea08d0caace7ccab
SHA2565e17fe8e933569542bbdd5d1c5a2b321ab397264ac60ece7290af77616b17c1c
SHA512b7cf85db7c1f8414ca51395f04eb2cec9043aac3b3f30361b11eecff9eb3795c77c843e9d07f94264fac9d6d624e384b6c47123fc278d5d4c9eb9dda622801cb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB