Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/03/2024, 15:31
General
-
Target
2024-03-06_42d0a28d255ad58cf7eb48bf722fc689_cryptolocker.exe
-
Size
46KB
-
MD5
42d0a28d255ad58cf7eb48bf722fc689
-
SHA1
93ab6a7d7e82b538d7c00112a85470145658af7c
-
SHA256
83e8c4c64a262b9c7720623d0f7452d8aba7dbe8ebf5f0d8bc6e095c28296b89
-
SHA512
712dcc30d48053984c18367a64f1d9f4dd90320b1c3a1f679db10d2caa257af3da24efb6123facf9c0aaa9b81974f0e2c69946cd7698fa26e2fcf6f6911a4bc4
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/7IN:XS5nQJ24LR1bytOOtEvwDpjNbP/MN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_42d0a28d255ad58cf7eb48bf722fc689_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_42d0a28d255ad58cf7eb48bf722fc689_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD526126e63304c6efde5024452c392d3d7
SHA1a54a40913814a006144bcb4358bf14ab45f19909
SHA25613bda0b6b07d5ded592a963bf9ecd8978d0482a3babf0a5c1e23f53075b6c2c2
SHA512f7ac8565976997ca33cd44e000bb4bae774334a22de4121905c18ef5e6cc4496e9185c8efcb729b82e3b386ae670ac5682e2ff76b3dae6c10aef7fd275d47fbe
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB