Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-04-2024 04:50
General
-
Target
2024-04-28_c96c607d1f7f0b650039721b5cd1def8_cryptolocker.exe
-
Size
42KB
-
MD5
c96c607d1f7f0b650039721b5cd1def8
-
SHA1
8bdcd3780c85808d9399c7ceb7ce808f0a46f7c7
-
SHA256
3ac37b61ddbb752b305062321808581c830026e3dc661f5974348b528812fd77
-
SHA512
d22c7ca761314f4b9971a9e9584825c8021d99631511bd37793aee8d1c9b6c386981f9e2f76ab4ff7b7b638b9882c5bcb70a512750eaf2671cdcae7a09093c8f
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY+iyD0:m5nkFNMOtEvwDpjG8hhXy+iyD0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_c96c607d1f7f0b650039721b5cd1def8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_c96c607d1f7f0b650039721b5cd1def8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD55b60de0c4f4b378006378027b602d46f
SHA1b711ddfcd416d5110d910c3ae396466fb0ac08e3
SHA256a9960ba2dcd75c934bb989af506c10e6265c355d6a5dfbfe145e45b93a401380
SHA512971784d88cb7283ab4a56d4a2bd1ec55978e02202b6e14e932b35c7b81a6b4bf88c9655df629d7a1ad6cfa902005cc92926ef5e8dd0df3e1720a89032cf0e93f
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB