Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/03/2024, 16:27
General
-
Target
2024-03-18_2c1464b77c367b791d15d1347b85915b_cryptolocker.exe
-
Size
103KB
-
MD5
2c1464b77c367b791d15d1347b85915b
-
SHA1
aa2e344bf673975a7274cc28baa2461d84a50cc4
-
SHA256
ecd187ae5d834a1db90563eafdbba8f66c5e8b9f93598854028d4868a6817bb9
-
SHA512
a2115416b3bfd318deee2b6a24e7a24e51c3c0da23ef2303cd760933637258ce363dae36c474ea4a0ad3a6a3289c7ce1b7a887f74f625f4cf0892bd1cf08f536
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNojlEy8fZwmP:i5nkFGMOtEvwDpjNbwQEIikgNyEA2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_2c1464b77c367b791d15d1347b85915b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_2c1464b77c367b791d15d1347b85915b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD582be62387eb2db137b541b283b30d491
SHA1b22e65be1e3c6a129f26acd12496ca8070aacd2b
SHA256839fe32e30f495abd2b82a064abafebfb8d7497267d4d0e05de8f413602f67e0
SHA512f16d6d907aff6e4ec85df319d3c49c9d986348d578ddb60505b95f4d8056789ac04af09b06da488a3f717543f7397e51a08229b18cbcb300118866d245f45f93
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB