Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/04/2024, 08:23
General
-
Target
2024-04-18_206b02f638cd840660aad2eef326f82d_cryptolocker.exe
-
Size
41KB
-
MD5
206b02f638cd840660aad2eef326f82d
-
SHA1
f111b5b4e5df16c8f622815f84697b2089a5a013
-
SHA256
62855e3f88166dfe14d5348a0efea00e63d09a0a25c467533c3c4808cb6310b5
-
SHA512
cfb35afa043c1822f44b9c61af96be07f0825eee4ecb32b7195241d0c28d7f8e55e10b38436ab4146e4514d66dd8de6463819b303efccfaf4d840f33605d10e0
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY+iyW:m5nkFNMOtEvwDpjG8hhXy+iyW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_206b02f638cd840660aad2eef326f82d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_206b02f638cd840660aad2eef326f82d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD52e809711884e48ca0a81434e94cc71f9
SHA1f0ea05dfc259d441649bb808001042d4bf54db24
SHA2566301c3fdea90ef67ee332107211ba6996126b0240eb2dc6cb6d5b8732e102650
SHA512e2bc8396db66752dec8dc1a7771d6210afb9eeb29e3e2bea8f77512b241c30adf702c3b21be69d5055003c591391986eeae37a22b65461ca29ac9e76f7e62da7
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB