Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06-06-2024 12:44
General
-
Target
2024-06-06_30faaab6706d6c5a82c26c13a2df867a_cryptolocker.exe
-
Size
43KB
-
MD5
30faaab6706d6c5a82c26c13a2df867a
-
SHA1
01467fdd891e7a717916bcec100b4cc1840e3c1f
-
SHA256
df83fe03c2ce3e76fabf8a07cdab459a0ef74f385d678ab1f8602ec57fcae494
-
SHA512
520092f2720d0f3af840edb02b97b0687b31be63b17d31ac5c4dc88449281d4343136e75186c7cd1f16131a233fa0662b34acf0a058060e8ac260aa99415d73b
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1n9a:m5nkFNMOtEvwDpjG8hgpY19a
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_30faaab6706d6c5a82c26c13a2df867a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_30faaab6706d6c5a82c26c13a2df867a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD514e83c554422ecd08bcd0c2bf2c81595
SHA1343428c2681d8c0d8d5de51730f981de7297a2ad
SHA2560e7e5733a40e87351f971bd1e78ef0bdf888bc8ebca56a99625a70bddd4b4076
SHA512c5e67320833767787196f37b87569744a18b7bde6902587ac23e794c45f243bb3680090378c25791a66218ec198204dddf506b0647f19f0c1fe41321a168bb8e
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB