Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 20:27
General
-
Target
2024-04-10_592c2f6abce98752e0ced1d9040073de_cryptolocker.exe
-
Size
47KB
-
MD5
592c2f6abce98752e0ced1d9040073de
-
SHA1
c2f257efbb465f59887da1b1420a070f71fba50e
-
SHA256
c5f19e5a69951cd93bfa88f8eb547bc1a7af788b2a2d94e02c66e730e17f040c
-
SHA512
90d1cfeac1c61aa381857c777927336fcb68335cdfe6c75becf8a28c726b68717a886d263eae4cb8586c1e44764fef8e010d9c4ea0852c23f7b1092696f2e5d7
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/BdmRF:XS5nQJ24LR1bytOOtEvwDpjNbP/bmz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_592c2f6abce98752e0ced1d9040073de_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_592c2f6abce98752e0ced1d9040073de_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD56d327a8619fd0d56746521f759dce000
SHA1f49a942c3cc9d4312d411184d59b910490318b57
SHA2560ec1a98f4bc3e8b6f639df325a41877995b9987fd070f61904fc4c901c175e01
SHA51223c6647641d3b6eb41073278e613fedf8eccf18d49ec40ab2c914789b0590d1f8ae9a4584d1820308092e2512d3b0d2e4a8260e67e78f95adb5ad5fe3209d569
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB