Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/03/2024, 21:34
General
-
Target
2024-03-19_8a4369b451873275b7cb07d2284e40fc_cryptolocker.exe
-
Size
101KB
-
MD5
8a4369b451873275b7cb07d2284e40fc
-
SHA1
183f2eb571f9388700f532542932c4390efa5297
-
SHA256
cee5bfa4b7437a29b613d8362739e0d28fb771ca3e700d5e6c13b0cf455af7b5
-
SHA512
bee9e6a27f79299801e483377f57c07e9b5562f018c7a63ba88ef503dc4e3a5c634f7f652c8e6800ada8190e35b2dbb4c36136359a2e46db4f97ec66061651fc
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2wSdc:xj+VGMOtEvwDpjubwQEIiVmkxv/g
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_8a4369b451873275b7cb07d2284e40fc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_8a4369b451873275b7cb07d2284e40fc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD50023c6e4621445e5a9e9e7823211e299
SHA12b8b1fa2eede1e4484b4879b8d416c358970c30c
SHA25667c8bed0637d51a600b1369bf1d294b4c98134c2d117413d67b987e80b3e6e89
SHA51252ba33c78dc8347c72db26f12755bd52d621a62890213271347a53321062e17a06d183635ae920ac6715c884e2f600adc5710e57395acfa4513bb07d7e2fee2b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB