Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/05/2024, 04:24
General
-
Target
2024-05-10_0911adc67dfaf309e208d0a4381c4875_cryptolocker.exe
-
Size
42KB
-
MD5
0911adc67dfaf309e208d0a4381c4875
-
SHA1
1dde2e935cd3888d6f3cb4df89ac52746cdb12a0
-
SHA256
5ddb5fc47fafabf7c528f3db2803adbc9ae60d089c189c10965b7063c0cc19b0
-
SHA512
d544106f97720c1b7f6ebe28317f88d9139c7fe21f19be32437b3e9114ea6aed5c2c479a428c3b32a6d606e76c9785b0f8cc36e92df59b4233287709a7bdb731
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aDE:6j+1NMOtEvwDpjrRX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_0911adc67dfaf309e208d0a4381c4875_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_0911adc67dfaf309e208d0a4381c4875_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5c5d3d110505101bf3d03b99142a3c4a1
SHA10f411a2f51059b5742bced880a4eddf84ed8a332
SHA2569916418c7ee7b749653648e66bcbd832263b80c611a513c4390885cc8c15e0dc
SHA512f8e2d4f26f12c2e2b2b8f639a30524a6f4c46f551e8541108a0559e2e2ff6483491c316a9bd15a75bffabf47eb65f67905d690103bfe0f2aa51aa803b79465f2
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB