Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/03/2024, 09:27
General
-
Target
2024-03-28_0e9fa819d30c3e152af3bc1a19a317ec_cryptolocker.exe
-
Size
101KB
-
MD5
0e9fa819d30c3e152af3bc1a19a317ec
-
SHA1
ade75383631bb6bbdbd42a2d07b56ed26f8011a8
-
SHA256
5011a59962f96a26955949d2b049332da72f809b3ddc2466767467710143a378
-
SHA512
7dcb4066c4e73511821bce035531b7b3d3166878f2f179ad96a5cd4141b87daf4fc5c94c5017032d1b736b81f58eedd9e7130964f6a99135128c94aedd0d95a8
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2wSsr:xj+VGMOtEvwDpjubwQEIiVmkxv/Gr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_0e9fa819d30c3e152af3bc1a19a317ec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_0e9fa819d30c3e152af3bc1a19a317ec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD54c944e0c2e392a3d84f96218fb21490e
SHA139120225547db3400fb4152801154c433cb485df
SHA25652affdbf7975591027dd557f90977c5fb95c9218e83830eac7e0341d6a492a98
SHA512f48e1e7dfb6aa2abed1e7f71eae6829c41d1c5351dd3f6dfc3acefb60b8ad435c8aa4fc8b728a7cfccf051397d3430be7d823b2d3f943451d835391edfb1ab80
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB