Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/05/2024, 13:38
General
-
Target
2024-05-17_dc03b51ac3e4cad6c997293bf6bb14ec_cryptolocker.exe
-
Size
67KB
-
MD5
dc03b51ac3e4cad6c997293bf6bb14ec
-
SHA1
9e9339998f3a571fb6d2ab8775b6f93ee4c5b52b
-
SHA256
b598907b0e7fb05829c8bbc0e6f27f7d91e7b3bf8ba62797210793e61b310746
-
SHA512
3968104cf5c9d023120cb8689a7c4dc6c1c7404e0e0fd76669f2220f74b6bc8c54d445d0a6febac12410bb8dd35c766714232389541c66e86c49d5e63fc156e5
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFIYD:6j+1NMOtEvwDpjr8ox8UDEpN/j7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_dc03b51ac3e4cad6c997293bf6bb14ec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_dc03b51ac3e4cad6c997293bf6bb14ec_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5470ae7a293d7e9ab80fdae92c858991d
SHA1efafe74ca0f5981b0fc7b6ba0df6197711501968
SHA25619cdfaf104db41abf1753f28626790e65698db0370a62b25236fee20f7c9f52d
SHA512d4f038945f79cd06a5345e6b3ea65d8756b7ec68c971dd6e4bc9e394fd122766313f8f52c7a546d6c6686f7a7d0f650b635b970659a9d314064538a092429755
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB