Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
26/05/2024, 01:04
General
-
Target
2024-05-26_7868abff49cdaabf6cee20dcc0356618_cryptolocker.exe
-
Size
58KB
-
MD5
7868abff49cdaabf6cee20dcc0356618
-
SHA1
8432fa0aeebd093d9ab84da9ba20735d19310c3b
-
SHA256
faf55df04f4b114403c12439006b6bb8ac86e451c7192b6723af29c34c2ae1d8
-
SHA512
85adaa236d6d31436420066b50618025eee54009d0030f592809fc0a80b1148e1b910fcfbf7026a5bc9fd447960e5fa86ec86cd73728294757be75718819e15e
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7GowfjSO:xj+VGMOtEvwDpjubEgr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_7868abff49cdaabf6cee20dcc0356618_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_7868abff49cdaabf6cee20dcc0356618_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5b939cffb6df5e3e964109c438fb19329
SHA1c5fd436b938a74e0158ecf3545365495f8a996f9
SHA256c5bf0bf1d8f10b0951f1ffff72be04ac8b979eb662abb7df075909820a26fb43
SHA512ef7b2085a8b3c3cc7710e08c191aba80d795b076b370c398bc7b7e6a23303898c44d5f9ca7d6ad79d6d8239574f7e8a3f83c91d62a0b38274155c5ce421d2bec
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB