Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
16-04-2024 00:27
General
-
Target
2024-04-16_2b523ef2c0e517b41756a049cdae47b7_cryptolocker.exe
-
Size
41KB
-
MD5
2b523ef2c0e517b41756a049cdae47b7
-
SHA1
a108314d54950e5b503bd281c81655e6f3a03d53
-
SHA256
b4df08b602eda734b39fa07c47f0724b929a946c85b65d4676348812ce01b438
-
SHA512
078c1b862b7b99a6fa3400c61a1486ff09b72781318285169ac0221ce2f69b38c324d547996d3ad9304866b70c6dad421daff45551a0397bcf5ba67002644415
-
SSDEEP
384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOOy:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/k
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_2b523ef2c0e517b41756a049cdae47b7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_2b523ef2c0e517b41756a049cdae47b7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5cce0006de3e1dee10aa5a6113db39be8
SHA173ed8e8dc5b7c5f5b8c68408ec8cc4cb8f6a87e5
SHA256092427e80711292ab43e30bc512feb2637d216d9088a25a18accd96f0b72da12
SHA5122b32d2d15e5422ff053a3e76b55429dc118f233933d4894d0a8ab88265222f841326ed92a3c0e4c9370d0387d68a24c9a6b7d8a6972861e2c405df81861f866e
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB