Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-05-2024 08:27
General
-
Target
2024-05-27_bc1de2f55d26266d9f4da5165539a9b2_cryptolocker.exe
-
Size
48KB
-
MD5
bc1de2f55d26266d9f4da5165539a9b2
-
SHA1
df9ff41aba8707e8daf4f15c049067270b3f8165
-
SHA256
e0a8222b8d8dfa7d01b09657e86af0f4be03842e678ca7e46349acc63b0aba73
-
SHA512
f6e999d6887c06516a000afccf8925946626a0034d9e4a121c11ee0d8c8eb507870bddc144e4ed04dc46877d541e1aecd4727f0dbabd81e1431cfc5fc7a962ea
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhAEl:xj+VGMOtEvwDpjy+TRhxl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_bc1de2f55d26266d9f4da5165539a9b2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_bc1de2f55d26266d9f4da5165539a9b2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD581a5fdbec14177a2cd070eee03cf14d6
SHA1f58c2ae301741cc15546b0986ece69a9871eaac5
SHA2567046b83f3fa512ec7225e7c88b3edc7ae2e5f93e0c41a1ba1e817eca96f07dc1
SHA512ae3b74a6b71d3e509b3b1c7a656ab43670c648cddc1cbd0c60f2f46854b2797ccdae04103b95b714b35c3df087da3aa36747fac5560f037d330a5b2acf36a8c1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB