Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
20/05/2024, 19:52
General
-
Target
2024-05-20_fbfccd969b89e7ff5f6b7cd3cc530477_cryptolocker.exe
-
Size
42KB
-
MD5
fbfccd969b89e7ff5f6b7cd3cc530477
-
SHA1
c66d58992cac9dac7698d54c65a38def5a30d141
-
SHA256
4eef863e1c180c4fc5c95d0ab24d834e21a46fa3798b6c1fb0c73be39d180f6b
-
SHA512
da4094e5cc0506b0a15b0033f7e844278807db9db1d8e0067b8a648c99313a3159962b29896b511f81c675290665c1e91e79cdad1724e0724401373acd4398a7
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZCe:i5nkFGMOtEvwDpjR+viHsce
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_fbfccd969b89e7ff5f6b7cd3cc530477_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_fbfccd969b89e7ff5f6b7cd3cc530477_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD514240fb5e2877fbf0c950959ed883f63
SHA1181e3321928f4a0c9834734a1d590ba73cda6b12
SHA256ab38f4aaa93eec68afa988bb67d9f3223a82a8b93db9cab57d5a00f7c2b17e06
SHA51209d03ef82028e4b4a6d6c40c96ddfcea497b265a05d925048bba2e95a3ccf0c77d597f5abfbe8874e463def4f76ac9072131cddc4de94f2c478cdb2ef3de39c9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB