Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
17/05/2024, 04:28
General
-
Target
2024-05-17_698d255fc89389f51a1c09577f2da0ee_cryptolocker.exe
-
Size
43KB
-
MD5
698d255fc89389f51a1c09577f2da0ee
-
SHA1
f53e94f761efc269ad4c1adefec228b279659cf3
-
SHA256
448e0554b558847c7c5f5cabec0876044e4859a1bed00d4d2f619dca79ff54a6
-
SHA512
c141d2abb671ece974d06ccf83ec831dd9ba004df1e04505f80407165507970a1d61938bb3300551ffa44f7e4d3fbbf3eca31975a3b8775b9ea4bc5b949fa799
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aDz:6j+1NMOtEvwDpjrRo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_698d255fc89389f51a1c09577f2da0ee_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_698d255fc89389f51a1c09577f2da0ee_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5ba60b0b2f1ebef7f1f28748004c147a4
SHA1b881eaf428467af82dd709531a25b79231a89bad
SHA2564140927d62c0f1a13565b306586038316b6b90cf20abef425eef56dbac62f284
SHA51288d4b73efd4668411218f4cfb62d0d65fabd0a0e01939e96c9a62575dace17d3d91163d89a0f27514261f09ece5afb5060bae3490291bc679aa2d71e68436dff
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB