Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/05/2024, 07:07
General
-
Target
2024-05-30_e7655355a0a1f83dd75dc1f0a619b888_cryptolocker.exe
-
Size
68KB
-
MD5
e7655355a0a1f83dd75dc1f0a619b888
-
SHA1
84a9ce9b84e47cf1194a7d5fb7eaaef59e0ea421
-
SHA256
473dfd6475e6088a07fc2cc8baf6be867f194a61096436f714f8e7ba6fa335c2
-
SHA512
e3fed02184ce1284e99cfa055c9e0b65f187d163fdf6ddb1d8ba52c7f2a7da48203368815fedbebf8121725d552e29aabe9fa1b5aba55a9624de0b66703c0264
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFIN:6j+1NMOtEvwDpjr8ox8UDEpN/jw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_e7655355a0a1f83dd75dc1f0a619b888_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_e7655355a0a1f83dd75dc1f0a619b888_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD546cc11618cbeb8396c6e4390820710b9
SHA152dd939c8bb4872475f87c06159f295870c74cb0
SHA256bf8ce4df5761c2265a942bdeb90ae51b2ae02301abb5a1482cddcedfc20af523
SHA512e2e2210e50bb276cafdbbc61bb796f9d11f5d7348486b1ae71f21a3916b10a422f814aacda07e5995e1c5974dbbb4892bd789453e5618d8936e485f58cd20d92
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB