Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-04-2024 18:27
General
-
Target
2024-04-23_990ffa0428f987eb35cc804c2f506c7c_cryptolocker.exe
-
Size
50KB
-
MD5
990ffa0428f987eb35cc804c2f506c7c
-
SHA1
af1744ee334b95a3dde66ed6b08e7c867b24e6b5
-
SHA256
ec32f02537c6285b206f5c78a72bb1e35dd1928e29cdd35416501b440d1650b0
-
SHA512
b83f33079c87a015f53d12a3cb9c1cc97b1712a1a1eebc7ad93ef041b901048eab4828dd324e127362e8396461f3fa831ae74e31596ad7fb5d96bf97484c85af
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRp5jvbN:6j+1NMOtEvwDpjr8hhXj53N
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_990ffa0428f987eb35cc804c2f506c7c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_990ffa0428f987eb35cc804c2f506c7c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5a22c943ed8018d54b593a10984d6e376
SHA1717d19abd8a7e9131cb6cad96cdf29c41c5be290
SHA256acfc0442bcc1a4be97dca687e35df053ea8c2e31a9ceb7661681f2c14df848a1
SHA512ee33917a85d9a9380fa93d33570c1bdfbf292087bc75ab5ea1ec10f1a45b8eff0cd75a945f39500e9c1697d4758ae9eb4e64b0ffc3fafbc5fc9e3d32653d2a4f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB