Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-04-2024 23:33
General
-
Target
2024-04-15_c8727e57bf7f7233e7c3f98a39a24dbe_cryptolocker.exe
-
Size
83KB
-
MD5
c8727e57bf7f7233e7c3f98a39a24dbe
-
SHA1
21f6ebe009a3c4e9a02298d965e6c257f09421ec
-
SHA256
8dfd3286977d3b2a69aac4b0480a70ac1e9a018c3f4f7844f0268509943602a4
-
SHA512
fee4957cd3638cb670eaee5df691a81b219b3a7af49972f3707b372e0057e5dc3761f22ca205c4b930e6a0c36bbbb8900c7d8885028c2af515e49398539581d8
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCc:TCjsIOtEvwDpj5HE/OUHnSMp
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_c8727e57bf7f7233e7c3f98a39a24dbe_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_c8727e57bf7f7233e7c3f98a39a24dbe_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5e47bb7d074ac0f99b1632bab321dd9cf
SHA194a0cc1259d196f7f0d4caee0694fafc4ec74cc6
SHA25692a0c37bfcdb63f4b093d8c7f782e474a97e0260b1a29181e3d3d5c8c1aaefa2
SHA5123e554a34771e8d7e3498578c7bf7c20c5a526bae867c67d328e364df6903af08ce000564639c8021e15964edfbe867cee6355a959d6fd22e512b64f658de7fe3
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB