Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
18-04-2024 04:51
General
-
Target
2024-04-18_7a8682a5d48abdb31bd325d25bc51483_cryptolocker.exe
-
Size
49KB
-
MD5
7a8682a5d48abdb31bd325d25bc51483
-
SHA1
6a7a9a1b7f34175d9b2d35fae8cce885984e6625
-
SHA256
2d887a560d440c53fa73c2c1aeb45b807d5c343497928461a30499757f55f62f
-
SHA512
7817c8690f277e85c362db2decc436f1166490132f936c074fd96c55fec9f39ca77610be594385f21347b006ea98d78ac6a935e8576a02b3b7e9cdde75608384
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHxl:6j+1NMOtEvwDpjr8hhXiz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_7a8682a5d48abdb31bd325d25bc51483_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_7a8682a5d48abdb31bd325d25bc51483_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD54c2514ebc72b3f21b7987d37bd6c4356
SHA1e310d11245b539b3b939190aaffbdcc951d8ee13
SHA2565cbac75ec0b9cf5fd1e4391d45d613c5bc15bc629c19bfa0378feff5985e5769
SHA5125346a0d411881faf19064c05ba6fbc01d1ef35ec40292dbf144b37df0eec88c96e69de52e76d5b7b206c145b4b4e4e85209538a94dadb367df203298ba3ca27f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB