Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
10/05/2024, 07:43
General
-
Target
2024-05-10_9aa132bb018e7e7d449384bff3ed3891_cryptolocker.exe
-
Size
48KB
-
MD5
9aa132bb018e7e7d449384bff3ed3891
-
SHA1
5da55fedaddee9f3c892fc006458a843a1419213
-
SHA256
8ea8889de43e780e567a9baf24663997cd6f29e723fc8f1ef034c04403db09ad
-
SHA512
278c44435b7876b727e1468cd2b6c1406eac8e6d0315aa870a088b1a745a60835c4c548f762347a190ffd0093fa77024e9e2818342f6efd59db5b8b7bebba229
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRh7ihx:xj+VGMOtEvwDpjy+TRh7in
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_9aa132bb018e7e7d449384bff3ed3891_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_9aa132bb018e7e7d449384bff3ed3891_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5716a584a290444411be9dc17ef49f3fd
SHA10725429f2227b48f5d3e1efe0de92a4d3271cc1b
SHA256142770ad71bc95e22d6bff4f87e7e2d501c18bc55792ec2292b9011fd34815d1
SHA512cdc8175434607aee55551133809fc14c4d3c19e8046c5894f096a86e54e777eb08d7cebe8b6557423a38aacde2363f676bb7dc7cfb185c7a954b9eeb18a68d5b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB