Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/05/2024, 01:26
General
-
Target
2024-05-27_3978d354be573ec78a9604d7f5394980_cryptolocker.exe
-
Size
42KB
-
MD5
3978d354be573ec78a9604d7f5394980
-
SHA1
96edeaa80d22493624c82015311ba7f59ce5b4e9
-
SHA256
324dfe3c9a0a8fab45e2690c65ffa93804ea9f815d7a2e71b5c4a3f200c10cf7
-
SHA512
18abf624301c6d70a14c3215ff6155af3a323783d6b39a4742a146c3f74506a9d9e5922e49eab7747241b890df2e8de771b2dadc7be2301f5b8b7b5873a15ad1
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhfD:i5nkFGMOtEvwDpjR+viHshN5D
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_3978d354be573ec78a9604d7f5394980_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_3978d354be573ec78a9604d7f5394980_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5079807efb30a98b931a4837cd6deee86
SHA137f80c89081331f7a431fb321148025b33a23d97
SHA2563d23f055ac1f79944dd081ee4eb9b325a848a2b245dc6f18afd5a86fbb1023cb
SHA512c796279f7d44a67f7fa9813bdb2fa55f67b8f4bd24ae61b170be299adbfc64594b1684bd7f43c2e72d99dd536f4620b36a70a45de3f5c84ba7501707d2402a3f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB