Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/04/2024, 18:28
General
-
Target
2024-04-10_1e7581093ad1b7c0865cb7646ba46c54_cryptolocker.exe
-
Size
62KB
-
MD5
1e7581093ad1b7c0865cb7646ba46c54
-
SHA1
f656b2a10b0c676e7b46b8950952ea29036e9586
-
SHA256
36177fe5bb17a91dfb37c4b4586fb407628e6313a755e79e14ed7887513a0fc8
-
SHA512
773a62ae6eb7fc48ea341e8e158f271b0d56f8e5f402795f87f602ca9e0511cf04f8ae097601065c4bcfe4c1b7111718f26066919185a8c2a70678c3a4e080c6
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIL:TCjsIOtEvwDpj5HE/OUHnSMV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_1e7581093ad1b7c0865cb7646ba46c54_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_1e7581093ad1b7c0865cb7646ba46c54_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD554470924a50c3de45c6d91ef08446ab0
SHA19ad4776eb0c2073fe8854086e68d8df139c52b4f
SHA2566578c91dedb2116ec7fc2218ab30eb56cf2f9f1e922e966e5dadb10c6b6ff1f9
SHA512c6d5cf2326e56d4c8ec96bed80036940695d15191d006dcd8f410fe3357b9dd9397e064023df166437526676acc517d2421b3649a4222de405454ee7dffd7fed
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB