Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-05-2024 05:03
General
-
Target
2024-05-11_a725142ac29fa797384dfcceaaed9a89_cryptolocker.exe
-
Size
42KB
-
MD5
a725142ac29fa797384dfcceaaed9a89
-
SHA1
73c8068fbbfb7481df490c33c168660fdcf40857
-
SHA256
ea17b7e4566feb76e0a5a7e3aa07b75ffe4c8d9c40617fb66d57c23a0af4d3e2
-
SHA512
7fd9ffdb43b91c1e03a6782262274c808f6e6742190eca9a6442a50a94cd8195921cf529918648c0a72f91e53b1dabbcf2aee81b200aec2f8fb8247eacbf1482
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aDN:6j+1NMOtEvwDpjrRy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_a725142ac29fa797384dfcceaaed9a89_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_a725142ac29fa797384dfcceaaed9a89_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5ca9d4c952ce9084b4422bc263e8f8f32
SHA1cc43992d934dac3846ed11ee7a2dbbe45472bd6b
SHA256eff54dc60751bca83b3073404f2d7f62ee99f3ecdfbf11fcb97f05e5a8f54b9b
SHA51241fec97d5a98908d184cebc80a4847279fc3b22fbfe70bad20bd8e37f6f8218cf439b700023c6a94c8b992a008e65fcf61deed8f1bb3daf7c30a28fca55fa223
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB