Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-02-2024 00:48
General
-
Target
2024-02-25_8c97a51f262df1eb0687859c3d270fe0_cryptolocker.exe
-
Size
42KB
-
MD5
8c97a51f262df1eb0687859c3d270fe0
-
SHA1
2929a45fba1090102b7dc51833c9acb067811c81
-
SHA256
eeb8d3049585e298f12f9e01c5b0450e36a605a3b2f7468cd215140c50c8ae4f
-
SHA512
b9bd8820bc5305ceb902ad87550752707065eb1d6e87cf837d65dbb57995a8a6750dd7f08c4f4445d30bb10d6a53d3c301e784a3c1fa1ed45862b599d3fa64b2
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvKO:6j+1NMOtEvwDpjr8hKO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_8c97a51f262df1eb0687859c3d270fe0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_8c97a51f262df1eb0687859c3d270fe0_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5eb74c4cf609a08e06ebe9ddc50896595
SHA15aea4744ee9f25c69838b47d65c66effdd4d3fec
SHA2567b6b3ed61b138d77477e98d642efe9eeecfc998a82fb5ca026ad1375b97700ef
SHA512de408768439ca955d56e8701c8ea80debc1bd79c704735d383792f41057c9ba4a5813d4c4599fbc902bba5c19fab3731f1809fe13e0d160e4cce7ee0b344a1f4
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB