Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01-05-2024 04:09
General
-
Target
2024-05-01_45d64ae408005e20be07cbb22728d6fd_cryptolocker.exe
-
Size
61KB
-
MD5
45d64ae408005e20be07cbb22728d6fd
-
SHA1
e6bdc056992e5523920dfc2d8b7b7e3b49064245
-
SHA256
dfe4a00f4d0620b3a646e7fb78c8ff72e80e6c00db33a5c6a4279d45a3b74c3c
-
SHA512
cab4adbb79092568e0575a94adeec823a46e486f33e2506c82177b080db07242bb80eeb25f09b2abcd4300f7398575485124978010bb4f6d228b97d3a0d3921a
-
SSDEEP
768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9R:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_45d64ae408005e20be07cbb22728d6fd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_45d64ae408005e20be07cbb22728d6fd_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD57469d64f4a9f6391276825c64ccb141a
SHA10ead49b0c30939f35c793f9068b0be8875211b53
SHA256453eb3cc48faf4fd8445f44515f0209043267d0e34b78cb9934d79b15b2a3d63
SHA512e87fc84cccd1b1e4024410d7dd8189ce21752a40ce95334a43d30fc15bac67edb8bbaafb7d7921d04314c9e31524ea08a7de8a6ea86a1751f0bbd71da4bf550c
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB