Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-05-2024 23:50
General
-
Target
2024-05-16_301e131ca89b88cc1dda84e4fbad1ace_cryptolocker.exe
-
Size
50KB
-
MD5
301e131ca89b88cc1dda84e4fbad1ace
-
SHA1
c5296fbdfb5bef9235cba1bc5b4fbe2485d927f4
-
SHA256
590ec9b8fd86daf36691c594f982a53fe1dcbfd7972ec131ab64aa5b9fc502d3
-
SHA512
32d09c1a57ad121ef7f5452dd95fe58bf6e6ec2dffd61cd312029153db35040d25a762793915a27d0837175e74b55294293e04029e3e980878bbb129d8e54580
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRsAo:6j+1NMOtEvwDpjr8hhXGn
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_301e131ca89b88cc1dda84e4fbad1ace_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_301e131ca89b88cc1dda84e4fbad1ace_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD56ffc03af1830a58fe5f2453b0e6cad0f
SHA10f5a3f5bb1812952f9234d8eb384b34dad841cb7
SHA256ea5c5603fd328262356938b8e199be5963090deb54f97c4c82fb71eca21fa7a1
SHA5125215c3457fcf35f47609e47cca445e08e67720e68dd01aaa6046ed7b091a498b1a5c87bc49814b2c01704b6f68b54af0b2a16cfc4fa4ddc2e29de1e868e29de3
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB