Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10/04/2024, 13:34
General
-
Target
2024-04-10_71f73868815db4b0e4bab76a49452079_cryptolocker.exe
-
Size
47KB
-
MD5
71f73868815db4b0e4bab76a49452079
-
SHA1
eeaff538587832618075aea5e5eab7371f98e80e
-
SHA256
a95edad8cb488f3c167d74241867ed438747e57fe1c528203981951786a77dba
-
SHA512
0837baaaf6c92414ff0e422ef36a73719222bbc76d78b6d5ce2bcaeb667f53d97670745dde122c00ddc5fc006e603bf86bdd16cefd288db8856a4a67d361ad1a
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/BdmRi:XS5nQJ24LR1bytOOtEvwDpjNbP/bmw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_71f73868815db4b0e4bab76a49452079_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_71f73868815db4b0e4bab76a49452079_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5b2a8b219902b3472a96ae3d10b65c37c
SHA1d7df7f5e5c149943c4d87a040e406eb50b1ef973
SHA256232b7433ac039ee07aa023086900f404cdc9b43e1fb51e2f21445925a345c127
SHA512f9f6aa826528d968eea03235efe589354ed42ebc4ba0429d153c42249ebb9aaece02b408c58601413bf373f0ce15cb0654c5f4b5f08b6b2428f8a297f3be0d58
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB