Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
09/05/2024, 13:24
General
-
Target
2024-05-09_3e8ad8ef675de1909e3b39fb026a5aa5_cryptolocker.exe
-
Size
47KB
-
MD5
3e8ad8ef675de1909e3b39fb026a5aa5
-
SHA1
e56f31363e2a80cbbc31b5c458e356ab70fde02a
-
SHA256
316ac4407ce6ae88b49cbf00d9add8631e6ffb5dfc55e01cac73e39a1008c4f3
-
SHA512
422bc3f0e0b41dd7a6475bc5268d5d6f02bfd3d675053c72f9c58b792db38537c19e9f34881afde6edf0be7f0ec906001f50104ddad48cbdbc210bcbf1ba6bea
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rva/yYsmt:xj+VGMOtEvwDpjy+viHsw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_3e8ad8ef675de1909e3b39fb026a5aa5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_3e8ad8ef675de1909e3b39fb026a5aa5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5a75141be44cafd42e128e2537216d0a3
SHA16bb89248cc25a44b99a23903024d74441271a2b3
SHA256f3df0af22815ec0202dc8e3e601e3a13627f3915f2bfb6b1bdc70cfdccdbc284
SHA512ed31427701f22407e546b8abb58b0c32e8412e493471c86b791a723a1a0fc3b2f5009b71f40c853d2504f67b9c93bb4c31b6b7db75405207dc55c0bd8e3ba421
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB