Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/04/2024, 01:31
General
-
Target
2024-04-11_2c15ebc1cf6227254dbd4799cb29f581_cryptolocker.exe
-
Size
51KB
-
MD5
2c15ebc1cf6227254dbd4799cb29f581
-
SHA1
1017a34af474bf83251531ec4eed207204eb457c
-
SHA256
f8b05a71f170b3785004ae78a49662d521220a74e0f74928237801d6c0dbdbe8
-
SHA512
1ebb6adc5e21109eb972f45d917681f2162f8fcfba0d97c15d4cdd9924629476f4b694bda43e083244629b51b61e6e0b6da7f033f6acb33857359d433626b490
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkH6:6j+1NMOtEvwDpjr8hhXia
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_2c15ebc1cf6227254dbd4799cb29f581_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_2c15ebc1cf6227254dbd4799cb29f581_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD50eedd6af78fa5d4e25eb7f2170c1d020
SHA1ea8b195effbeb85f4d1240cdce5cbd19a7b6d8d6
SHA256740d64c698494e3484177b6151a144b190114dac69b6a82271d866cfd010289a
SHA512955103906cbee26784ab3fffc6b5fc0ecfbf20753927e21f83f80ac99ac72516f3e5c5c02bc36bf08d439343af69696998ec846096041a8c45c6d02dce926f19
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB