Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/05/2024, 20:23
General
-
Target
2024-05-12_33e222d925e33691b09da2702ca63a28_cryptolocker.exe
-
Size
48KB
-
MD5
33e222d925e33691b09da2702ca63a28
-
SHA1
dd90e8328f61e5071f9c68cbba5bc14ae7116c79
-
SHA256
e829570dd050d186159e17bdefead87bd0b2775baf91ba88b55529da0851ffa2
-
SHA512
4868b976e22ffeda116ebb2af1d682bf829ace38adc6cb0e2191697a4574b93afa48c5c49fa0a25a70a261733f6b4326b669f88c0f0e697ceb91ab479f138eb3
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhAm:xj+VGMOtEvwDpjy+TRhd
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_33e222d925e33691b09da2702ca63a28_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_33e222d925e33691b09da2702ca63a28_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD57557869b307d57e757ff199d99a2485f
SHA144ddb14cd9e2d5fe890d84d2c0be30d3cfa6722f
SHA256eacb919e7abd4b34a56a7431042aca0f5e92b912d2eab05d654523a9ae31497c
SHA512b0c01c643cab910347114ce794c1a91d65cf41bd7b438fdcb3a192fefc0cf6408defa70fac0a25616bbe6b651e5f7116a75c438df73810b340aea1fea62b6c0f
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB