Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/03/2024, 14:35
General
-
Target
2024-03-06_9c7e279c481d1901155f8a5f49a9d6d6_cryptolocker.exe
-
Size
100KB
-
MD5
9c7e279c481d1901155f8a5f49a9d6d6
-
SHA1
200ca9923fb000371b860aa56ae8bdf940a7475e
-
SHA256
3d3abc692296493cc438c05676e9788037b79ad8324ad6deb1218add959de508
-
SHA512
0642ea06dd3a8b2dc65c77766bcddb807b9b1f430cc4db6665427b756067983db378ba1c6684c46ac2e4f9b388f13bb109b5d83c244026cef7b0de1f6cbc0550
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjz/6wr:i5nkFGMOtEvwDpjNbwQEIikrp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_9c7e279c481d1901155f8a5f49a9d6d6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_9c7e279c481d1901155f8a5f49a9d6d6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5ac5ef8407f6f5a07934b4f26ae3cdce6
SHA11f4d1ee01f034261fe03893c129d7e311d81f6a5
SHA256f84f97a683a53e5b1f9174ed41073006041fae74b176f56770ebe9af16dde044
SHA512fbec24ed3d0871faf8b7fd3f5013f008b2a330782dc93f14ea99dc418422254378bdfc909dc10c64594e2c144709d133b21cd8556ed79caa1977b8994d622674
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB