Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06/06/2024, 23:23
General
-
Target
2024-06-06_20c7f088b9150472d39c86beb6684083_cryptolocker.exe
-
Size
58KB
-
MD5
20c7f088b9150472d39c86beb6684083
-
SHA1
579f924b90ceeda67c4c1d4cd7276cad29a377dd
-
SHA256
f230b6b3dfc54af0afdf057175ed09ce2dee4fac8b1697f0f08eabfa9823c68a
-
SHA512
1cfa21fce3e7047958901fe0f5403b989a9caf3ff61f9d59028c658ffcbc4d6349ded5535f764df1def9ecea6c85a17c39a2799652e271e980dc5a3252a158df
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e4E:6j+1NMOtEvwDpjr8oxExe4E
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_20c7f088b9150472d39c86beb6684083_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_20c7f088b9150472d39c86beb6684083_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD532b84bffbd9595894eb60ab6c62444f2
SHA141bb011cfe3dbc63258d3027210a9da69189f9f8
SHA256c9bdb7f318c6e3fa63cca50eea6c9482f1df59d69ed8f82cd9173312b81825a7
SHA51266c8fc23c9f8cf09e7b50950e0a7c28d35112a09731e44a6d6f0466f9a74c2dc944f006f470101537d624dc5b9c6dbf3c7f943874d2410cfd733260aae0adeec
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB