Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27-05-2024 16:50
General
-
Target
2024-05-27_b40273a2eb01d1079ff857a27c1e339b_cryptolocker.exe
-
Size
53KB
-
MD5
b40273a2eb01d1079ff857a27c1e339b
-
SHA1
fcaa16d747f145a69c4d8dd31834efc023505db5
-
SHA256
0c1733d73b024ffe307f52268cdd5d1aa19c0ade271afb980bf2e50a15d9f834
-
SHA512
6ce3a339fc93cb933eb6a7736f3365acffd4a485af250ed8f7055f20b9adfc7318a77f0c05c7eb679465c80585242c206f909703bf3188a1eab22453f9af1e47
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHD:6j+1NMOtEvwDpjr8hhXij
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_b40273a2eb01d1079ff857a27c1e339b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_b40273a2eb01d1079ff857a27c1e339b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5adc53dca92c44ccb9a28d17570a77b37
SHA119f699c502e5f770c08a884b6fd935cf610a307d
SHA2567250d15dec62f00ab550e68fd36a2110cb653424c1de659078a2acafe82f62a8
SHA51205caea014368d446d589133e4db24c097d0762ff910622c7fe40937c5d8f854fca204884b69655f8db4b5d0af5df810134692212f2e0291361b57156e6542faa
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB