Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
16/03/2024, 12:34
General
-
Target
2024-03-16_69365107e5126c87519d1d754f6c76b6_cryptolocker.exe
-
Size
38KB
-
MD5
69365107e5126c87519d1d754f6c76b6
-
SHA1
1c46b41c334cad0ee9ddeec3dc474ffff1d3e54c
-
SHA256
a032f5fb4084a8378818e0a4f481ad0a94f644e31a2938c8fb347000ade2ca0e
-
SHA512
41a0e403803a5963949e72e36c65db20d9fbfce9a3095a5e03b77ac2cd9049f2ab98307d229b2080bcb8377bebc5a129f93fe7b5111a7bf1b97a7265b407d4b0
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRjS:m5nkFNMOtEvwDpjG8hhXI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_69365107e5126c87519d1d754f6c76b6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_69365107e5126c87519d1d754f6c76b6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD50a79ca38a58fc1bda665e99543ee2d8d
SHA1bc56e3878101469167df9e2124edd5b973821ab4
SHA2565a3e0b70edbf8de6ed9e386fe315de69eb24917d1593e5f8e204622020328050
SHA512fdc6ea0affa0837d66f7031ba1fb69d3c256aa01582164b57a0fdc49580fbc096c7f50a857678032ccbf2a6c24c9232e27cdb2cc71c1d429de4216c14327b943
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB