Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
16/05/2024, 19:42
General
-
Target
2024-05-16_58fba31388ad337b6ce406652332bea1_cryptolocker.exe
-
Size
42KB
-
MD5
58fba31388ad337b6ce406652332bea1
-
SHA1
fb49ab4e0830e1fceb899eb2926de602793fc3a7
-
SHA256
0364a02b4866c99032c36362980be77242aad9a9ca2f16c438208f9965531e8e
-
SHA512
61029f4d310fdaa2c3d8f2a2489b29a0e05eaa5f87ff19509e5d3b34f4b43b24c6c512cc5b70277d72c062141b12445bd4d782419c4f9802e1edc2e486c036e0
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhc:i5nkFGMOtEvwDpjR+viHshNm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_58fba31388ad337b6ce406652332bea1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_58fba31388ad337b6ce406652332bea1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD586fe6a812f48145bbb22b14da43835b3
SHA173edb9dc483d30a5c1d5b5793cfb22a9b84feb27
SHA256cf62d483fadec66b2ae7dfc3c44b3a87614316e09ef50baaac59c2fa9fd9e500
SHA5123f84eddcc84a7c5547f4c2d17d713d60d25e3c73ce840542177d53ede6014ee774b582b053255ed5a918eae97f2073ef575bfc4c72d8b6a63afc0a15c2cf5dc9
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB