Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01/06/2024, 22:45
General
-
Target
2024-06-01_cbe3e38085f160d7effd3d69f7034322_cryptolocker.exe
-
Size
44KB
-
MD5
cbe3e38085f160d7effd3d69f7034322
-
SHA1
edc3eef9306d2893715fe399faa25eb7e968ac67
-
SHA256
f8af92ecfbdf6a98afd554399616eaaf73106da6a4d2c4d17b402e7fd23a51fb
-
SHA512
4f51db9d318595d281740b4f7b594e660531f44fe4b4d147a8255912ef5576298aacef1bffcebaf865e4c132142e706d5236a1829b51245495b560876652cd1c
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aM1Oc:6j+1NMOtEvwDpjrRr1x
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_cbe3e38085f160d7effd3d69f7034322_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_cbe3e38085f160d7effd3d69f7034322_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5abcc5cf7928d14a158ce0537adbe843b
SHA18c56a74bb9b147a0fc6db7c9f7585a9c545c2cc2
SHA25652f9bf50051a9f45c0d2dcc0a451975f5e6cbaf2515367451d62240517db530f
SHA512ac07ed2e210bc75785a4308986e0bfb272a88b8fe3de36b328ef1fc740c10db8309dea9e726aa085e3ea67f50f43c46b5855de6ae76acc2d8967c1dd0fc0578b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB