Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
27/03/2024, 14:45
General
-
Target
2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe
-
Size
40KB
-
MD5
d89fef1243ef2e0acaba97e29b9dcdd6
-
SHA1
4a4970b377b7fe72738a244f1473d361a92f66aa
-
SHA256
1984c9a8baee90d64b3a2853d49835f2f5f653ab56672fef8e1484fc5a46664e
-
SHA512
767e92a46e41c1f7302446ce8e59681678f29f4046698c5c3e0cd22f9a7d4981bd85e548be6ff485b0fba121ed7ad6d02d3c90a0383ca69d0187cfce54e56c45
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRppts2:m5nkFNMOtEvwDpjG8hhXzzs2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD51222957d2f1f44ca673723f164074de8
SHA19e7f0910e199f94301717dbc4b2a7ae3cdcbac9d
SHA2562402b124f3ead22ad75451c12443a3499d66366b5f6817d8c92d23e12a665079
SHA51203ff4660513f238409db140ff2b9d0946f74adaa012607cdddf7eb66ff2a3bad3c7bd79b2b28dda7517f43693910423598921a5885e1fb8f1428dd4b2c588736
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB