Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 16:02
General
-
Target
2024-03-14_084fcb429942022cfa5c29f8d2640baf_cryptolocker.exe
-
Size
41KB
-
MD5
084fcb429942022cfa5c29f8d2640baf
-
SHA1
6e4820e12c50148bd0180988f9fc48652aec1e24
-
SHA256
6d7ae2f757179d987dc0e1a7e0578a065e19c5e8f768d961303f705a56280194
-
SHA512
a3ac3d70e895f9b90cc212cfd1101719db386c0a2173fbf6dbb4876be2b66ca323c23cde29a0e596f863c7c8ca5e214c69ac7a619931516463bd301a79b9b1dd
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKajxJa6J:6j+1NMOtEvwDpjrobxJBJ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_084fcb429942022cfa5c29f8d2640baf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_084fcb429942022cfa5c29f8d2640baf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD58268538a8651898a7f79c486aca9d818
SHA17038895a5395df73ed1aedf67d8709a51797f7e5
SHA256855f32a82a79ba9d0ee9f9202a8a3e2507eb9c34c640c92cef2d2ba6b1275d8e
SHA5120c8cf5c6976a08b0d81544b040b4472a350bd902f5fe4f4cc7ba06ada56c9b1756d69305a2cc0daa39bc837cc0b74ce8d2cbe9b08f3d7822d6d362638869c746
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB