Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
11-03-2024 21:35
General
-
Target
2024-03-11_cbc2382a60ce63e50b3c28badb8a76c1_cryptolocker.exe
-
Size
49KB
-
MD5
cbc2382a60ce63e50b3c28badb8a76c1
-
SHA1
05fd6051c7550374efb583fc1f0dc5f099b69876
-
SHA256
7408ced6e646a00249b1908cd89a17a3afac33283da6f103bca806a6dab26c7c
-
SHA512
5ad8a1c370a8d8715ddff44b10c63bd164272cdde3ade723bf5dacf05239be19a14dd79c099c7bae2995fe729de6e8918cbe81a88ecad36a69fcbff67791ff6d
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHU:6j+1NMOtEvwDpjr8hhXi0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_cbc2382a60ce63e50b3c28badb8a76c1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_cbc2382a60ce63e50b3c28badb8a76c1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD57fa83cf01c2410b8ffb4f9a5a8606bc4
SHA155332cdafb19aea3a5fa117973b01d331ef24f9f
SHA256e9dbd71717a9c14f4c482244d4983e63f81ece5014271333a02f0af7b4f2fc9c
SHA512d5a2b0276766db55b4bdff58fc540c757be8debf909ce36bbf8511ae745e70b7d4d1e4622ecc2967d4b0699cd6b958e0b115940839a1816976a5a836bdda1848
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB