Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19-03-2024 04:37
General
-
Target
2024-03-19_659f33b8cda7a4966cda7a335f030220_cryptolocker.exe
-
Size
46KB
-
MD5
659f33b8cda7a4966cda7a335f030220
-
SHA1
9ae4b81e2b3960031c62f69f4cc516e0be38c730
-
SHA256
5890e76724e375f78715b3bfc531e15132da1db0102e3ea414851481052632c6
-
SHA512
b9a4f4dd95a89e95d03bee07e46682a4d3e4bcc739f1a4f1e733ea975004c4d1edfc8e83e7ef9e58167ca7efe58d9a584b75862f94625e214937034e5b2c8192
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/BdsQTN:XS5nQJ24LR1bytOOtEvwDpjNbP/bsSN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_659f33b8cda7a4966cda7a335f030220_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_659f33b8cda7a4966cda7a335f030220_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5b5912ca9b13a3e3084966547da3501ab
SHA13f9afa98aa6fbfdaff6447d95ccf92ec9a0f0f08
SHA256d3f4b67e57bbf419492d698b3bb41716e43bb53dfd93d7cc1669927a15b92c3e
SHA5125c1369ca093a8e79fc18c431dbee4a05d5c52d22b0ffa6a7d2e04f5dfdf74cbf0837b8dd961dcef784716cd696c86ba1fceb08b7300d4ba37851e764b4ca7432
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB