Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/04/2024, 17:28
General
-
Target
2024-04-27_08cea536e72c2f443a53419beada146b_cryptolocker.exe
-
Size
41KB
-
MD5
08cea536e72c2f443a53419beada146b
-
SHA1
94abd01bc6d45aac901e8a643328a22285326c4f
-
SHA256
0b0e57dcf990ec6cd396b7fc6432904e51167321ca1914209c296d0215ce92a1
-
SHA512
b84bfca052d9446f7bad50f748baa7217ccdd7c4daa6a448abfa4b19852ad290528e6d6a73f6c23bfc07cc0b4ae3817374f127dbba9419274e8ec3f49fd50121
-
SSDEEP
384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOOO:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_08cea536e72c2f443a53419beada146b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_08cea536e72c2f443a53419beada146b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f5dc2ab35b009021d893efdd2e006db2
SHA10c257df1bef7a1c54b9d62f5b1c7c7e3e83c99cb
SHA256c1fcb2e8bf721619b935b0679321e653154c789103d03b05d98e2547ab139a61
SHA5127bebd92a0f6bb23530ba5badfe4c477d072a4b17d48e61a57c15d33c7be658cf35882c223eae6fbc8f7cde102c526f520509ebe4b82e2dc80659479dacc4f192
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB