Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
21/05/2024, 12:27
General
-
Target
2024-05-21_354581f581208e1e5f3b5e5873c10ab9_cryptolocker.exe
-
Size
42KB
-
MD5
354581f581208e1e5f3b5e5873c10ab9
-
SHA1
d08fe2097617a0b5d823df2f82cb74bf9f925915
-
SHA256
abaf2d2eb044d0a12dca0a302d2ee7157321e8e78c080d28c38ad5e6169ae3b4
-
SHA512
b5ab1688ec05bc0d273377cb1f81076ce0a57f3e8d0a0a1acfd797a30d156f70465aa6dac45ab275aa89280a8dadc185db2e76188be426b679b50e500a288b9d
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1n9c:m5nkFNMOtEvwDpjG8hgpY19c
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_354581f581208e1e5f3b5e5873c10ab9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_354581f581208e1e5f3b5e5873c10ab9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD519b645aca00d026d442ea9ac6dde422c
SHA1c42e38b0c943e360eea2b85a8a1a3b4c8ede95d7
SHA25623c1b2d0698a3e7a739725ed9167b22c3fdc246ee8a7db952c7710ab2a1bf4e7
SHA51229e1d845e079cc3f6763e7d192047003db5a88a7f82c3edeabf6b24c743b1f2c71e50446def6b37c6bf083a32739678addd3092bed90b503ba26c2decf540df8
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB