Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/05/2024, 01:16
General
-
Target
2024-05-10_adecd416328ad2fe4080d6b5b76b724e_cryptolocker.exe
-
Size
52KB
-
MD5
adecd416328ad2fe4080d6b5b76b724e
-
SHA1
5560299b106d4eae7b56c7d2844d1a61afc5aa27
-
SHA256
d6fdcaaed4a15a4366521035782cda6b81e88b26f12408ab2bdf878397391fc6
-
SHA512
c5fb41a0e904e08fb5d7e30868a6599d7156371cd51a3d924ac39b3d1f806f517459935f908999aff62ce5508835c91ed41584cb12ffdc3732e1ee063b0287fb
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHy:6j+1NMOtEvwDpjr8hhXiS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_adecd416328ad2fe4080d6b5b76b724e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_adecd416328ad2fe4080d6b5b76b724e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD563690bc3a49e202b1c84266c9f7e191c
SHA1232acd6ab7f120b3357b44f2da67ab4061d99418
SHA256c6a9a7d5088a29ad5e577a6cee7c1291b99d93da2989b1971de9a62a8ab8e989
SHA5126fbc90af4ad29d7c21e9562b13e2aa4f7a57e22e372b7cb1919fd9296a6cd50a7a64906bcb160e6101e18bf3ab1617e3b67806826694ce7050e0e90f928e7ba1
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB