Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/05/2024, 07:28
General
-
Target
2024-05-10_2893384b3c7b92632126c68985bc3574_cryptolocker.exe
-
Size
50KB
-
MD5
2893384b3c7b92632126c68985bc3574
-
SHA1
2024ee393859058f4a35ed8759c756c7e881807b
-
SHA256
524aaa02729b1a0fa782f534c144f854037f51496ec8c0767c215ce7f8086e32
-
SHA512
c9f6da8744634a240ed354184b3b5fafe50968e403747a88ff57b1a5346d497e6b743c86ce4e3bb85bcee5d76edaf352b68ae29f6062ffa3b31ffd9dbe06f447
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRY+iyye:6j+1NMOtEvwDpjr8hhXy+iyye
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_2893384b3c7b92632126c68985bc3574_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_2893384b3c7b92632126c68985bc3574_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5fc71ebb372d76ce234ffa36fd848273f
SHA14895af675f81866678eeb8008d55aa8b7ee470e6
SHA25672ce05f96c4d416d6858f318f1997143c14967a1e07e7dc32b32409af49f5f92
SHA512ce8e99f2c3a7f39d6630a52b08f3b086fce9a5f00b92f76bcbf4b932af2a39d9ec36fd0dce0e74efbcad7e36de6019ef37ad063688b44a96db39389cd67a7e76
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB