Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
11/05/2024, 05:51
General
-
Target
2024-05-11_7244ebb80d88ebddbf50103f9b65af3e_cryptolocker.exe
-
Size
56KB
-
MD5
7244ebb80d88ebddbf50103f9b65af3e
-
SHA1
c32f5d1d57e2dc4b1c19158efe2f8ff669d70761
-
SHA256
2882de750fd447057c0d54e691177ae57662f2c52fb39643f630777a68e7a0ed
-
SHA512
dce6d474b3c843347d64aa58b0cc42294a6fdddcae00168e9c16b085471f283c5960fb99e4c0d2719e2ee25d5456e26602162ada8d1c0cdc205d29b6cf7197da
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e6M:6j+1NMOtEvwDpjr8oxExe6M
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_7244ebb80d88ebddbf50103f9b65af3e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_7244ebb80d88ebddbf50103f9b65af3e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5f4718b88fc7420baabd9c7059f04df96
SHA1d5ec8b83b945141d9d1eaf5ce13615539fbf570f
SHA25609e139eed31bd203712d3406126fb8f15f30889e92654cab4922a9a9101a490a
SHA512a08047733e93a1dec8c442f3405d7bdba8078941c5ae8b6ec4b9bad82ef1bc66594074f3938cde589da4b5783126a508c36343b7aaaec05036529139032bc84c
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB