Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04/06/2024, 17:20
General
-
Target
2024-06-04_7239c72684196e7c8426cd16e6c6b7d9_cryptolocker.exe
-
Size
67KB
-
MD5
7239c72684196e7c8426cd16e6c6b7d9
-
SHA1
f4ee84a23e386ccea8fa513095c34647941bd234
-
SHA256
93778e501003175c970991e1881b3c83d388d565fb60277d4a851d873362057e
-
SHA512
95861d5cc8f4e3bbe7ef2c64e40f32ad48db10dbee9bee9a5803e999f1c4d317f2fb480034d5d79ddccb10cee50fb72e4d8837a04d575cd99c5465fc576b1d32
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdfGyy:TCjsIOtEvwDpj5HE/OUHnSMYj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_7239c72684196e7c8426cd16e6c6b7d9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_7239c72684196e7c8426cd16e6c6b7d9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD50238cd7a5c871e8b5c763af21087ab82
SHA17280dcadf199147d42fb904d916ad4a8d9966d6a
SHA256ce72b19054e625e8421cae30223bb5bd226b867c96bc3dbd4e8cb1d0bd0d5aee
SHA5121c336c6a73c21a6a76be284ad79ed98f643a3c3f4adcec5241adfe2e4b26759b93af8c6e1145b8dad8fcac776e2dcd8c24d8a0c21cb294cf88a3f8170797f19d
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB