Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/03/2024, 02:30
General
-
Target
2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe
-
Size
61KB
-
MD5
31bbf383d9dc191e069f649ccce47e91
-
SHA1
48fbf2577174154eec91b6b6281385b495bda62f
-
SHA256
fb295cc4bf1e3897bc1b93c4bd3c573071816f57cd741d7836b3b7f9efae268c
-
SHA512
dc510552b7b0ebc63735f59bf0c12f0413a835bc4f5ee017277b93f1a297f6f5594a3eed088b6c40efc3f2ab034a19d1b82eeac5a75e275fd5545a9141f17e85
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTI4:TCjsIOtEvwDpj5HE/OUHnSMS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD55d66bc37aa4d01f6dad7bde136fc2d00
SHA1f960effa269f272fe189b25a9cb4d6f7ab01eabf
SHA256eb7d23492b34afde8ff67fa943eb3b743e1057b6bc806da324da4183b71447cc
SHA512c5e2262faa2d094484059dfa8b4364b53786e33e3d40c5b96ced2de76bd0b4ec630ac8a4d6bee8e309a7dfcff67c8749bcc2820195cc46ee0c63c88a2fd8f329
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB