Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
31/05/2024, 14:44
General
-
Target
2024-05-31_14c04a84a375578ec1191dbcc5c49de7_cryptolocker.exe
-
Size
44KB
-
MD5
14c04a84a375578ec1191dbcc5c49de7
-
SHA1
6699810c60fe2f403cf98f5b9a0e2d09946165fe
-
SHA256
3f8478310793ef7b488aad8a9cdc8f144a54b2e5123cdbafa7486153951e7ad6
-
SHA512
914e9c59df3eee0a1eb082ef39e156a9c7d01d4e73b1e53c028aeab6b3ba46e772efc0265067293ffcc555bfe74deb58e2fdb844b151901bf95b6aa386f09bec
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRp5jM:m5nkFNMOtEvwDpjG8hhXj5g
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_14c04a84a375578ec1191dbcc5c49de7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_14c04a84a375578ec1191dbcc5c49de7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD54928c353486d717591181b36bd87c7c1
SHA1308cf560705d0ec281e8e81447b15e0093162939
SHA256871abc2d8dcb7205e7bc615e7ad448c0b4a1d11e5bbe41d777d5558e16624884
SHA512e699caa143f1d5aa037614c09a93c4895da87f0017fc67098bcdddd304958546fc9a88760d2850c151a6dbb4066ed74e6f84a05d52821d36c4c215ee89ae3f7c
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB