Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
12/05/2024, 03:45
General
-
Target
2024-05-12_a01c09cd41c6d45ce8cd19f078dd884b_cryptolocker.exe
-
Size
41KB
-
MD5
a01c09cd41c6d45ce8cd19f078dd884b
-
SHA1
02daa48290fb834c6f8c68c4739c3a2e912120f2
-
SHA256
6d3c24349e3eebd1f7c26f3016e3282f6ec9e029f1fefd61c1136dc58a198786
-
SHA512
63246586f4de2c169b82089d85c7bc8bddfa9c35e5d48ca527a64fb0f9086d3def427c9e27d6c45958ed8cd1530cfae16ebd499ab9bb1a5b1b0fd39e2cef01bd
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhh:i5nkFGMOtEvwDpjR+viHshNH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_a01c09cd41c6d45ce8cd19f078dd884b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_a01c09cd41c6d45ce8cd19f078dd884b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f56782e70099dfdc9d151fb812cc5134
SHA1cc56220bd73e92ed7b0bab7014f720d7974d4596
SHA256676037e60a0f8f80c3c020539a3f4e687ac44bba53520c602d1edb6b2f59a5f6
SHA512517bcbb1af9867fa9e9bdc2ff22705e7778e14b38d256c54fe6c0e25ab74aa5fca93ff095a6d2234f0bee9263211be3463e5500389d30d19ad426c9f9c3db72d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB