Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/03/2024, 06:49
General
-
Target
2024-03-26_e9056510cf4ba8664ce2c0381bea4e8c_cryptolocker.exe
-
Size
40KB
-
MD5
e9056510cf4ba8664ce2c0381bea4e8c
-
SHA1
0abdbfe22d2a4e4e2b2053df0e65b2ab2deef0ae
-
SHA256
f351534a45b3321089730a7e3c1ef5d0eb70e2afd19a73752ff38d7999d81cb6
-
SHA512
0a99d41f671c7d41f08bdcbeab761aefeebacbbc90d18c1eef0955e1c3d6c4757a4df33a6dc0b4863068876b53681b886e75db41d4f57768e9982c702aa1cf6f
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnH8h:m5nkFNMOtEvwDpjG8hgpH8h
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_e9056510cf4ba8664ce2c0381bea4e8c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_e9056510cf4ba8664ce2c0381bea4e8c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD564f07f3872acfafa93cc2dcfa1858a5d
SHA121b215043f934e143ef342323812df7a4f5f86b7
SHA256da28d3bac3536caf9d90a4bec7c5213fc3c510f468392672aa0007e7fa2af4d7
SHA5122813f38b7662fe051e14dddc991aa4f58cc03c2300473472e6eb610cce6742a898f9046f11eff9645ef94e7a416cc8c0f3d1579873f721033063470be98fc0a5
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB