Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16-05-2024 22:28
General
-
Target
2024-05-16_d2b397f8097c4290c82a6b95dc365e8f_cryptolocker.exe
-
Size
68KB
-
MD5
d2b397f8097c4290c82a6b95dc365e8f
-
SHA1
ab0de6223117a40b27eeffc5c8af821598eba9b3
-
SHA256
8dca91e7046e7215d4f934f4ee2787208d8f8727c4f7915d09384873727aafcc
-
SHA512
e3a17aead59775f0093c99861340fa3b30f3fca51de4b434bcfb00e4275693d81ca9676c90c7837b62c4a529388b72dfa2ba08202be9c6e40f68f79e1d9fcb32
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/e:i5nkFGMOtEvwDpjNbwQEI8UZDG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_d2b397f8097c4290c82a6b95dc365e8f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_d2b397f8097c4290c82a6b95dc365e8f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD59ab8d39237b187870b8586c2c1b76cc5
SHA16473548df12b4773980432ba5277713cbd066d5e
SHA2567497bb4c2007eeed86bc61c23f8f723c3cd5bed580dfe2a737138d1c11980006
SHA5125a90ce44a49a0eda16f0f2bf11fc0c6909648ea92e39ea390d4adf0f1c31a06e19aab71fea122ab12d1721638c28fb372cbcab597f2a2411637362bca9bd0d19
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB