Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/03/2024, 21:21
General
-
Target
2024-03-10_1582531a65ea11f9c6615ed6fde39898_cryptolocker.exe
-
Size
97KB
-
MD5
1582531a65ea11f9c6615ed6fde39898
-
SHA1
ebbd13197dc7604b87316abf3d8d88199a85010f
-
SHA256
8f09529880e99d05f007f991eb49b9f34eb99cf221af7d9bc761dc56b3d889a7
-
SHA512
a33f83c449a9bb09d2165522f2d6acb66fd461fd12fd720beb8e987a11fd29991619b133c93a7565fe1852bfa1232d757bf82fe18e45ba72ffb43a1856cf9f34
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJvfT3Xa2:xj+VGMOtEvwDpjubwQEIiVmkfXN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_1582531a65ea11f9c6615ed6fde39898_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_1582531a65ea11f9c6615ed6fde39898_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD580b509db222f83835d35976f4eddf66a
SHA1932fe8cc582b8992087918ec7c496e1cb46ccdec
SHA2566a1e944810e9a7625df4730b3f21f83f9409efab068417a973c54471b50c9d76
SHA51243af6b2cadf7a7adab6dac91af44980eff60283f0a7bb0476208eb8ca7c8c11d1cd35b2bd82b82aa67e5a3f9e71fe04b5c7997376fa7d90332d056c06ef15c36
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB