Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31/05/2024, 20:46
General
-
Target
2024-05-31_e237fa47fea432aa9d2c7a46fdd2c34e_cryptolocker.exe
-
Size
51KB
-
MD5
e237fa47fea432aa9d2c7a46fdd2c34e
-
SHA1
7fa872b74d82dd4f46375052f1d0656876413a85
-
SHA256
8cb3246b625bad89c8023ddade249f3c78474a3f056ffaa48d6cc217f8d53802
-
SHA512
eacc32ff5e34dd7655e8fbeb77fe5c82bd83510119c924cc24ad3867afffd0988e7c9f8c7adb0bb1b1b60a63ab542ecb8eb595cef893f0bf42e0dd971f781208
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRsA1i:6j+1NMOtEvwDpjr8hhXGL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_e237fa47fea432aa9d2c7a46fdd2c34e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_e237fa47fea432aa9d2c7a46fdd2c34e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD599d45f480ec50ff6a779f0311029e7b4
SHA1f868db9719e0f4a7c1602d512204777a1d14df97
SHA2568ac22143acfd4faebc5b2fc9c56d8cc97e09cbdff1e6b104629e5f9c423870de
SHA512538dba02d65ea51d2a3ff6201d7df72f69e4392578d7f2a260b7ba0bedbf63853585dcb4f73e42304239d8e91ace7c21c17968bceae3886c0f74306ce9cbb5e4
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB