Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/05/2024, 20:52
General
-
Target
2024-05-31_fe0c76804f8578114f91e5ea666eae92_cryptolocker.exe
-
Size
96KB
-
MD5
fe0c76804f8578114f91e5ea666eae92
-
SHA1
98632ddac0d8e37d5ccc7de2cd2afebaccae6b36
-
SHA256
f6b41ae2a3e3d0699e224ebb074aaf456299d52d6cd625239d1c819e52ce0c49
-
SHA512
6c1fb4c632ec5df8ccd9f3ec5372788d4dda0326ef7c9f24c5c792d220df2e345fa6513de7b0b1f9cfc35388afcf0ef74088f18e148cbd33c855b8acf5a33139
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvAcc:xj+VGMOtEvwDpjubwQEI8UtzNcO8Acc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_fe0c76804f8578114f91e5ea666eae92_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_fe0c76804f8578114f91e5ea666eae92_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50be4e1a85b070b0b6dc0f644c3a9efdd
SHA179970ee5dfc10807a08644eb6fe131bbf5ff5cf8
SHA256b0ed3b8ab83db4dbbb9aac610ecf1ea92bde285e80090b0b754c2717b683d6da
SHA51247c7d9057a508a85ee6ffb981ef40f0c01493bd6644abb16c8e4a26b5c03b0cf8aa861c142851798f2b492609ace58b427b15ecd3246931232f285ccfdfb8a4f
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB