Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 13:44
General
-
Target
2024-03-14_7c2691403586205a7476a3340dc345ad_cryptolocker.exe
-
Size
128KB
-
MD5
7c2691403586205a7476a3340dc345ad
-
SHA1
fc16566509fa954de4a457061e11810e13095308
-
SHA256
1b019481e073be4a6e546f014d0f8d3ac2ae46ccd6cca6523e9218988e40501e
-
SHA512
e82e0eb698c5fcc06dd7dc09ab4b6011d59838e3885ae7749f0b9fa75ecdfd9a74a1f79cce66015e5515a3a03d0c49aa294b47b9f04571fd4adc6b31f13efd17
-
SSDEEP
1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBp2Qvpu:vCA9OtEvwDpjVk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_7c2691403586205a7476a3340dc345ad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_7c2691403586205a7476a3340dc345ad_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD56dd0754c6331da1f8298598bc7684d01
SHA18f16752b4fd722a43a658d255cdba230a782abe9
SHA25668da65fe61e185cd8b644ecdbcbbc70eb382993289b47f82f2bb04a0d7c1cfba
SHA5121c0d3391db77816a420d4f1f932b4e055e8ae13dae5515524d38f1cd9edc91d7377016f6460df22500a0eab42b542e7a521367727ca9694bcf68f7339471382d
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB