Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/03/2024, 14:35
General
-
Target
2024-03-25_ed810aa59cf6b92c89691871b323eaf6_cryptolocker.exe
-
Size
97KB
-
MD5
ed810aa59cf6b92c89691871b323eaf6
-
SHA1
e88c602f12305405ccd7c218f550c6d855dd309b
-
SHA256
38ed27e112cf8301c786d9ac90323e18ec4fa461d9c6c2e1b619ffc56ee6f9f6
-
SHA512
abf05b4f32feca916a25e6be4adcd5abefa425c85fe8cfa62a67ad88ba4123e3da136050d584bce75fcd76f140809f661108607ce6d24b23db51b540dd7078fc
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJvfT3XaF51:xj+VGMOtEvwDpjubwQEIiVmkfXm1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_ed810aa59cf6b92c89691871b323eaf6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_ed810aa59cf6b92c89691871b323eaf6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD529c2a407df9945313ffa0d43ca889780
SHA13ce417639715a891de6e694f3eba22ec14f89d94
SHA256a2ccc1586c79f8efe35133483137f231c1227b653a97b50c9396a8e3c9738500
SHA5127b745d6cbf932e43a8c08fd4e47ce5c73462e0ba2d775be10a27d6150c833dcd7b568f6211a957ca675effb6b4f4c596ef84cccc40a42c89cb126e0b7dc0762d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB