Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
12-05-2024 20:25
General
-
Target
2024-05-12_496a8a0e0fefa3a96202c516230ff663_cryptolocker.exe
-
Size
48KB
-
MD5
496a8a0e0fefa3a96202c516230ff663
-
SHA1
c461675cdd686fd3f22a560a4ce781f82ad9fbd4
-
SHA256
85552232b35fd13fdaaf1a06219f26fad03c6763a8b93cc3636204ee7dd1c65c
-
SHA512
c83c870d002e5a0e2580a346b89fa34d96a3ff311ff6fc8755ae500fd44080307b5496b9caa6cc5c303b7488f1adad68058af2d8404d0f0a67adf9c909fec755
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/BdmRSt:XS5nQJ24LR1bytOOtEvwDpjNbP/bmu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_496a8a0e0fefa3a96202c516230ff663_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_496a8a0e0fefa3a96202c516230ff663_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD56fa599a5e630c287ab3f1e3587a251a2
SHA10f0477ddfd0bb3605e06e181d7a099598a54a85c
SHA256d797f77ea7e3bda0238f12dfe5c3b73ccd1af22b9d2c9f3d79f829be86a06199
SHA512adad61b2cd47e03c9745ff127ed10e03304589cb7f33c0c48865bcfd6452585320f6272f641729faf91c85c7440ff56832d433e794d77d33a6db3cffed50c446
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB