Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-03-2024 20:39
General
-
Target
2024-03-27_91f47150116a2e7b51f798b23dde781f_cryptolocker.exe
-
Size
101KB
-
MD5
91f47150116a2e7b51f798b23dde781f
-
SHA1
b124a18e713021a3a38fde2046039a77d4a61055
-
SHA256
cea086049388eb0027e13a006c64f46595a32c2510345daf77236ddcc9d27995
-
SHA512
d5a8e648bf41e8ff74ee65a92605127cb33972454a2d23699f36c46b736abf5fe27dcbd734ae686c7e0b186466e5cfa37302a6fb31b1c94149c774e4dfd4c553
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjz/6VVG:i5nkFGMOtEvwDpjNbwQEIikrV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_91f47150116a2e7b51f798b23dde781f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_91f47150116a2e7b51f798b23dde781f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD50a045f82148ba8e330c612dd60b9f37a
SHA186e9306e856ccdc0a5ac8bccbdc787619b25cc7c
SHA25639870de4862cc116680589c1b6cd097208195a4ad627c7288056f660580d5fcd
SHA5127cac1b7ece0707e01b825dc169fe1b7efbf5cbf3d1b3e1ed3bb7385d68d418d40a4512e6bc0e5212bbfba61e26e95711fb8afbd9bc40113d4f7ce05b0b8f9ba8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB