Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/03/2024, 15:45
General
-
Target
2024-03-05_e75651e367431c84a0c31e25f235aec6_cryptolocker.exe
-
Size
81KB
-
MD5
e75651e367431c84a0c31e25f235aec6
-
SHA1
161666092db779c4b016235443d2047bf5bf22d8
-
SHA256
349c80bc7011cc283dc6d024b237712c88682f8262e87d8f8dc35c29e7c9a5c2
-
SHA512
1efe82ff6caa32cbc00a0016c80093f6aa4a98680e89d861899465582a227e123c662472ff9272812c7ff22d39c1fd5a0d263db7767771d8fdb658141eea3ffe
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMM2:TCjsIOtEvwDpj5HE/OUHnSMk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_e75651e367431c84a0c31e25f235aec6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_e75651e367431c84a0c31e25f235aec6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5ae50a4b84a38f191615d7d22bd1fdb6f
SHA11122141042c289db78487e62d607c9ac8719017a
SHA256ada71f66254b46ef1e1123d54c2665eddb2c349c42dd06b250908aaef3307d35
SHA512b65e560bcd82d3c6b60e53d24c5dbf76cfe6f79e5b68f849e0d49cce6d32006de781077367a7d6ee98edbba3bb8b65fe8988b162813914d6a266d7a8f5e5d3d2
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB