Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-03-2024 02:29
General
-
Target
2024-03-13_441121d74d9a56e1f7f6b6678e35edfc_cryptolocker.exe
-
Size
41KB
-
MD5
441121d74d9a56e1f7f6b6678e35edfc
-
SHA1
6d1dc03a924656194b19dd27b1004ac73441434e
-
SHA256
d364fef53f4220a8aa9bedca691d722c1d5cf96a5d462c52a64c1c90661deded
-
SHA512
5877da831df19b82042e22cbaa6993c440e53ee9180ae5efdba2c5aa8f8fde2fe612ade54418a9e20d0ea7c71406e7c16f08b1820ef37ec2d516e32099808587
-
SSDEEP
384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOOC:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/k
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_441121d74d9a56e1f7f6b6678e35edfc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_441121d74d9a56e1f7f6b6678e35edfc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD56b227ec669b5d78c2cbc8217da42cb17
SHA1d8ab7e3730f26134a68189524e4a90f953b2cac5
SHA256610742dca8b704af38afa34dced77aca4cc1f6541311bef1fd9c20f7c368c976
SHA51263e87a2bd19cc334fac44fbf81a8bb232fa769bd5fdeb1ceb17a706a641c0a8fd1bc502cb0bb8d6aac13a053d6bac2a5d9fcae6b8ef920b642a73005d1f79dd4
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB