Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
06-03-2024 01:48
General
-
Target
2024-03-06_97b0767c1dfc4525767fdaf312caead2_cryptolocker.exe
-
Size
40KB
-
MD5
97b0767c1dfc4525767fdaf312caead2
-
SHA1
252823233e237b9817ef6eebfc9505591fb02429
-
SHA256
0c75e14ed8291ecf78bb38705ce426125c4017764414001f270f8e60a41a6399
-
SHA512
50f6fd94e6652c19f455b22496a1e135af6a9cd0e81a8e426e7694f787745497a7c324ff27395b974383d63a44a76802ac8970fe810543bbe4126939fd050da2
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFR1kbb:m5nkFNMOtEvwDpjG8hhX3kbb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_97b0767c1dfc4525767fdaf312caead2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_97b0767c1dfc4525767fdaf312caead2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD57d2b2e2994ad39191f1dcfe28331571f
SHA1d31a894eb0696c4e612cf149b46c49a7758dc297
SHA256c982a1263b0e6437871874bd37eaee4e0df46faf9e220a6d2fa3e1e105835b94
SHA512318732cb175f3e390cc7ac881bc258ca6f01f4a492c3b993321c2f8eaba440a9cd66642532fe25958643c8d9481f8bb20bc228294ff1783312d6a97cf841c450
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB