Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 20:27
General
-
Target
2024-04-10_69acdd0fd75e6c5c6dbae19f58ee0f6d_cryptolocker.exe
-
Size
41KB
-
MD5
69acdd0fd75e6c5c6dbae19f58ee0f6d
-
SHA1
1eaed23374e373d004b701f9ba6678342b54686a
-
SHA256
cadef3502b6f8c4494a38d8c66eb02f6c90e33110edf26b74d5ceb03726cf2a7
-
SHA512
4a5bca27d22a6aee1d7b98c41f0820e372c66917f543e88c12493858b8c52faf76b90b86d24223e97ee2578c50833d12de23fb5886792a284db0176859723e71
-
SSDEEP
384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOOe:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_69acdd0fd75e6c5c6dbae19f58ee0f6d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_69acdd0fd75e6c5c6dbae19f58ee0f6d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD58f5918713b6d2ae297cc6705c64a8bb2
SHA1656e0fdbf57d81aa4faf346c2e135292f655cf34
SHA256c80ca24d4b30c8dca1fa6551235f9489a6ced052ef37d2ce478201925d388f7d
SHA512d47189ec52e2f079149c68ccdb5e30d3d7ea09abf403e0c0488f45404ca84cf14475347db0e0c83c8b1efafbcb0c07e646fb761f7d121e7fbfcc36f6ae87dcb3
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB