Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-06-2024 17:53
General
-
Target
2024-06-04_2af240e747678040301ab37a407eafc9_cryptolocker.exe
-
Size
43KB
-
MD5
2af240e747678040301ab37a407eafc9
-
SHA1
f424604d23361ca28b6e26325208b14b509d81e0
-
SHA256
72fa3b6f155081da8e150e3c3196be8374b4e794df0af22a6654dba7c67f1763
-
SHA512
f308dbf605f9d14643b909e4c46a4aa78acfa1a0794fab4128bf0e9693413356c5945e77d3458ba84dc966483f5d3c9cd815088deb5c76a0313e31af2406e1fe
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabM0I:6j+1NMOtEvwDpjrR2XabMD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_2af240e747678040301ab37a407eafc9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_2af240e747678040301ab37a407eafc9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD521b70623fd73d0f672114d7f54015713
SHA1ebd69682cccfb781016b8014bf47927bb4ccc4fe
SHA2567ec658c83f1aa9d96bf8bd0fb3fcc58f17ba6f60239390c7fb828837b0210d37
SHA512d8c3e2cea01801c43eeca66f61a3c91621c05d2f718e1f8c98816c50dca36d8f3bf266be637e10a86c9c4a65b8f86b18c729f597f1e7af1d7a05f2a8e8d8877f
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB