Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
06/03/2024, 06:32
General
-
Target
2024-03-06_7db6a51445c2c559a94d68d1fb931b77_cryptolocker.exe
-
Size
40KB
-
MD5
7db6a51445c2c559a94d68d1fb931b77
-
SHA1
0a18a232ff257301a8155e39e42fe9f9ce83cd8f
-
SHA256
7be5923f3f97fe5ad8fcb28398013b1c9f6baf1fae1ce36431d9a6abd186a699
-
SHA512
443e183e33d0bafb286fe83749dc033ca851325d0591c5c3bedb7b7c4474499a37ff78fa02d286ec97b5dd2a9146ee65098051ea99fd5d4df8731aa65472c47d
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnISct3:m5nkFNMOtEvwDpjG8hgpu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_7db6a51445c2c559a94d68d1fb931b77_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_7db6a51445c2c559a94d68d1fb931b77_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5e1dd77a91661850ef709613edd13a07a
SHA1adfb8ef4b773bab94cbb18b7a404a9a912a01074
SHA2565569189c128b0e83a01997082e00699c01d34c9c32e239ba54aa488e3ed0cb50
SHA512207b89ed8991fc963468673cd031ddf88429a3a5a75d242e38bf46f8040c15900693fda9c80f2900fd95f397b745ed36266bfc235d369194c8a494306f821afe
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB