Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/03/2024, 01:17
General
-
Target
2024-03-19_e4386461de75ce4fc5d25893492ba4f2_cryptolocker.exe
-
Size
65KB
-
MD5
e4386461de75ce4fc5d25893492ba4f2
-
SHA1
31b4e0fa058a75049d233c8e049720db317dcaff
-
SHA256
767ff8a21bd1659b949cca1f545a0eff33d7a25bfc0287201ef1532f2dac9913
-
SHA512
ec490131fd484e7aff4c91b3580d76eac5f263c1eba4d103117e0f306d03a668b5bf6c289582d8180acce93a4a7f03d3271d50addfa81b166b5a0fde3aa9f9c7
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEMoNUxS:6j+1NMOtEvwDpjr8ox8UDEh2S
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e4386461de75ce4fc5d25893492ba4f2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e4386461de75ce4fc5d25893492ba4f2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5dc7efc7cd894aa79faeb46d00e7d1dcd
SHA1499c2c2753f81fa4c3f8100563d6638915e0fed7
SHA2562023da86b65957ebe093a77ed8bb8b67880a64fc73ef7074ed84c672121eba96
SHA51206a74c3d458351534e08389ca9fed5de8e970ada883cfb8a1c6cbbd30916bcef3428979b2dc68beba359c8728f48f410118aa026c849db287efd5eb79ac3328a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB