Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
19-03-2024 04:31
General
-
Target
2024-03-19_3fac45f60b9d2efeeab5babf548cb3dd_cryptolocker.exe
-
Size
65KB
-
MD5
3fac45f60b9d2efeeab5babf548cb3dd
-
SHA1
6966415e5346c01b2dafa1892363c23061f5a588
-
SHA256
39938cc3d024b207238b70206212c244a5db9061f88e26cb131902f7b7bc598a
-
SHA512
281164a5dc504fe529ae1be9f320d56712534c7a2579124e231a6842f3d6021c8c978cd9c7f75a869c037f28924b6decd9dcc126a52e2ad8332bd44d9f491f7f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/x7:6j+1NMOtEvwDpjr8ox8UDEpN/t
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_3fac45f60b9d2efeeab5babf548cb3dd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_3fac45f60b9d2efeeab5babf548cb3dd_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD501b515fed828d2778b41e04184942ae0
SHA141500ecd4f30e65e028df113cf61d5f939782c7d
SHA2564ed83b0c3749ac8050b479bf140aa94f7a2977b242aca2d0a69656d25c68e29a
SHA512b006166846a13d84f3b2f8bb5f07ddcb9708b0fd552a5da3b9486f6d4ba85139062cd83df50c0ac663498f076f261261be93f4b8424101cbf6eab278cee5a26b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB