Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-03-2024 12:46
General
-
Target
2024-03-25_71179ae256b4bac3823a7bd30c6fa16d_cryptolocker.exe
-
Size
41KB
-
MD5
71179ae256b4bac3823a7bd30c6fa16d
-
SHA1
c5742077851ca7b6d9cd469867e780e4109a6bb2
-
SHA256
4f6e5bf122b71cee799ac276ce305ba6df7fa56de0137312af844bdff9a7d516
-
SHA512
8dbbfe52519e35a4c1643edc554958130b5ed323366de3e9043ba3045ab3123171aa680417155afbd9d192742186eabf81d869709dc06ccdb9693ee657793fe5
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRSlv:m5nkFNMOtEvwDpjG8hhXIv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_71179ae256b4bac3823a7bd30c6fa16d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_71179ae256b4bac3823a7bd30c6fa16d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5207ca045af0d9a1450e0cbe174ae04c9
SHA12318f820bcbb37cfbd9d0011f1f82247d24c834f
SHA25690fbf636ebedb0cd0ee1b390ce8aee9d4d7fe36a9919daacacbdde9a08163b7e
SHA512a6cde594d9150478ee96502d954ffc60fcd2b9d30e2ecbf5162bef04c3b0ea6370ed128db38bb9e6f6429c4e7d5816ae9349299c97e2b8069de10239991e92ed
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB