Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17-04-2024 20:24
General
-
Target
2024-04-17_12c4240bbd882b35671aeda26ee800f9_cryptolocker.exe
-
Size
40KB
-
MD5
12c4240bbd882b35671aeda26ee800f9
-
SHA1
39d8f34a3601260dfafa2c8398a230fd1c2293a8
-
SHA256
9f299e1b8c26c629b6d5ce71f60aba577d59c6ef0ace657395a1a8c6db40016b
-
SHA512
ef58680f73caab8b731f05afb3014a3fef2ee6084fb90e72439ca4f5451f07159c873e634a5406085571bbbc3961b483ac9c1178f8c4571b4c66696f561f524f
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZs:i5nkFGMOtEvwDpjR+viHse
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_12c4240bbd882b35671aeda26ee800f9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_12c4240bbd882b35671aeda26ee800f9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD57589cd4a2ee0adfe4efa26f3496eeef0
SHA132a76dfbf92020d864d936ce13a5aa803b1dbde7
SHA25683ad5d6a7e5448fedd7cd74f561942edda4aea2630094b33d9cd2098e586e42f
SHA512d39f3e04d93e3489cb0ed62d1388458759386234a4d41ecb075bfbbcc73f9f45a6af16e92fce6c6185fa68524899ce3eaff712c7082447b278225c98f1333edc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB