Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/06/2024, 06:23
General
-
Target
2024-06-02_10343e6a06d28333fb05faa7c70c5fe7_cryptolocker.exe
-
Size
47KB
-
MD5
10343e6a06d28333fb05faa7c70c5fe7
-
SHA1
03374bea38c647b74329338e4b25ce419ddc4e92
-
SHA256
6780139e96a2272a36678406918e330dcef203afaace35b30557d252635340a6
-
SHA512
ce17dc1c72352552f22b036a9819e2ac2995b0809a521d4d433adc34a2f633b14319c20429e87b42710c15d1bdf71dcc4c77551253477fcaac0083ecb9bcf541
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhL:xj+VGMOtEvwDpjy+TRhL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_10343e6a06d28333fb05faa7c70c5fe7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_10343e6a06d28333fb05faa7c70c5fe7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD530dc9df8b5338c27ec506a1590b5bcca
SHA129e608b773352ebaddf06d76c0342ecef1ea04e6
SHA2564ef134472e646d495cef835b669c47cbc44c8ff9ea8f5e043f660b442dc1a725
SHA512d5032d73d9e1d73a5725d588ea6d6d337fcfb994c375e76cbec2c2adb4d1a1cb04a97983d31c6b722b61c7de859598991da3e2ee541d49123e506bddc9f5b9ab
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB