Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/03/2024, 19:48
General
-
Target
2024-03-08_c4d53913d6e5ea505ca4062bbcd24698_cryptolocker.exe
-
Size
37KB
-
MD5
c4d53913d6e5ea505ca4062bbcd24698
-
SHA1
6cc8da88dd06f8d82d681cfee1195dd11a99b35e
-
SHA256
526dee2187a53decde53d1e7fe186c68a7150a5277fe9bd8d8d810ea25e60063
-
SHA512
770ed132aacaf9cac07e97b32c6079d3229e8e4a08b56ab2755533f7bc26a35f37b1815febb308f45a7f6ca0834d4ba39f77a5ef8473604699b55b31bc2b7b39
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnv/uY:m5nkFNMOtEvwDpjG8h9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_c4d53913d6e5ea505ca4062bbcd24698_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_c4d53913d6e5ea505ca4062bbcd24698_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD56de32bbbbff08fe3f2298eb0a5b11fc7
SHA1864169b963dc9f630c716d9b98f9638608add407
SHA2567e7cfaaea419389c383eba3f008a7c83f260464440105b5505bd71ebc153ee38
SHA512c3c1810b0324998984668434a7ca6d4a131dee5c0f4b1836104708532b88df92c71bc1c7b6cd9d54932b71c44fe338a2b97d572b4af8c8ade890149fddac9f6d
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB