Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
01/06/2024, 02:33
General
-
Target
2024-06-01_ea3623cb07d7870ca8fa47e36be8644f_cryptolocker.exe
-
Size
58KB
-
MD5
ea3623cb07d7870ca8fa47e36be8644f
-
SHA1
6a70b90fab3d27be12514674ba6260130a25ae9e
-
SHA256
17c9cc433247c41e2d186b9c30553b8fd3d16416c0964a61527cf3677b1d0a12
-
SHA512
848d4e1e7cdf6b555192ba9e1f75af81eab4d83d429e1272553494d4948b48d1b7b6c8ed56a281bc66b864a168af169fff0f7e0d2c95c91a7b115bb3461631ab
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e64k:6j+1NMOtEvwDpjr8oxExe64k
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_ea3623cb07d7870ca8fa47e36be8644f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_ea3623cb07d7870ca8fa47e36be8644f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD50e110420d9c3e593ef30a4c5772590f4
SHA184b41c565df0e8c440a35992be6d53b12f0c4a5e
SHA25632cc29cd353751f12b5350c69c9c993d07b0c2a3bb4bac7d66aaa91cbee87194
SHA512e74a76b32dd087a425091de79562d8e3b14cd94683c0717b1acfc9bff357c051628d88a48df7c29fd54972a91c1db08194842666769418d860096a4ae0a816bc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB