Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/04/2024, 10:38
General
-
Target
2024-04-08_a14c7452f3b1d2b07eafdac132af5d43_cryptolocker.exe
-
Size
101KB
-
MD5
a14c7452f3b1d2b07eafdac132af5d43
-
SHA1
c2e760b205dc35f028f0c1185f31526a6062bf97
-
SHA256
65629e116f6bd273c416efe645e25ca51b323de26d9b8f9bdb1fb3d25f47430d
-
SHA512
a35d0654390181b5011c75c538ebabded88f31f09bc1801f44a355ece5dd1e51033b3bbb10dc71c2ee45b6b3bf924012dd2aa5d5777aeb96e4883096800bcddd
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNo9VF:i5nkFGMOtEvwDpjNbwQEIikgNYX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_a14c7452f3b1d2b07eafdac132af5d43_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_a14c7452f3b1d2b07eafdac132af5d43_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5073c0f15eb54b13708156f12231a62e1
SHA15fbf2c4a4e0aeafe4f7960ef65ee8662830b67a1
SHA256f675f177005b392893bdae58a4b282d48c6c8e8b47e087bbb16f565343a78d74
SHA512f3d11ce106826b4519fa32dfd88b75a43fdfe213a858b0126c6b193dd8eb0c42808e2ebfde589720a58c3cfed6024997431032a75faee910a49177d155a630d8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB