Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
11/05/2024, 06:19
General
-
Target
2024-05-11_a112c39eff3d00d371496151283634a5_cryptolocker.exe
-
Size
68KB
-
MD5
a112c39eff3d00d371496151283634a5
-
SHA1
b1bfe54051f3acd0e5520958d09e4401b4badb01
-
SHA256
8e5e3cb4a4aa0615651ce3f58f7b0c7d4ce4f4cf7da8fca7939e1c3ef86f3793
-
SHA512
f6c793fc0542bee97d8203d542c9cdcbe400546ccc31f9e722677d55a9afb520989f456c27750aa24f35b50c5424d32a63d23294f7501594c65d4ac6bb198440
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/n:i5nkFGMOtEvwDpjNbwQEI8UZDf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_a112c39eff3d00d371496151283634a5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_a112c39eff3d00d371496151283634a5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD50c6c4b63cde067697bc2b3d5f31ec46f
SHA1bcf46d5d5c7891e831734d9677e66b07c0225925
SHA256a8bfc6dd377befa46fb52a922adea23439c791a9810b34c060bf245b4533f6f8
SHA5122dae41832c8d5a9848217a66234f5325a73172e9ca29a3e80bc722a9241a47cef5243788fd89c36c05e2d7a90796f2771cdfc2dc5841bc8e16aa93c741fbffc6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB