Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/05/2024, 10:44
General
-
Target
2024-05-09_a19f326ce70437092f0bb92291b6ea11_cryptolocker.exe
-
Size
42KB
-
MD5
a19f326ce70437092f0bb92291b6ea11
-
SHA1
8acb3863ff52e209eb469d5b3eef57164f4d65fe
-
SHA256
0316f2e3ac3d423dea6d62c0f215804d9a73c7aa2bf922758d1cb14ec5ba2a8c
-
SHA512
8a6cd77917a11fe652b7a8d09447a8cf496aae57584051afb66e050cfa2ba90f4a8c54cdd792181c042e6565fd7674bf9f7610c0642395808dc71f85b6a1f1b3
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabMwQ:6j+1NMOtEvwDpjrR2XabMwQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_a19f326ce70437092f0bb92291b6ea11_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_a19f326ce70437092f0bb92291b6ea11_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD59427f5c125c4e0600e6edf46d6acb558
SHA183a6951f05533a961f17c87f105473f601d6188d
SHA256eacac3d10d7ef2c30fa48f4ae4aa714bcd26393b99f62319e7664e9ba123a10d
SHA51204c8612ed955f2ba46fa3a57f5aa77d401dcd5af993ad0bc3caa4af50e661a865fb500155ec7ae44efb0faf4782940b8d3e8122aeabaafd4b252ee46cf619676
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB