Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
05/03/2024, 14:28
General
-
Target
2024-03-05_63a4e5614c41b2e755e8e53175f53c92_cryptolocker.exe
-
Size
39KB
-
MD5
63a4e5614c41b2e755e8e53175f53c92
-
SHA1
d88d7eecabc197731ecf6115c5db0f994d5c02ea
-
SHA256
015c585eb6a3388e84638b111521b912c432e1a5ec6570af50c4ebbbb3c05153
-
SHA512
9a469e6b4c4eae150ec13bddbe7e608661beffbe0b5b0d0687a49d56bf33b823e3c2797a928efed0721de8ae2a60380bb2cbbb5216747375f16289847127e311
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnS:m5nkFNMOtEvwDpjG8hgpS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_63a4e5614c41b2e755e8e53175f53c92_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_63a4e5614c41b2e755e8e53175f53c92_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD589a8b906f50a3b06491f62df15f08928
SHA1bc304b1b2e2428316dd8e4326a45aa00bc27337f
SHA256e0746d938a8731455b930b401a34f1b6bb3ea161fe7dfae9add52b289ff45fb5
SHA512c965765edae61d34d493901c5aba8446bf70ab8500d92b32134aec6d0096923280493cfbf264d621efc36667bad0fd40df064429193e73dca5f1a9d4a1a3fb8d
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB