Analysis
-
max time kernel
70s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/06/2024, 19:23
General
-
Target
2024-06-06_09a84db49f44727f1cf6b5582a448463_cryptolocker.exe
-
Size
69KB
-
MD5
09a84db49f44727f1cf6b5582a448463
-
SHA1
4349a26e8e6447fca2b5d955b625899550983670
-
SHA256
9975e0b5e43242bc2732aa98dc9a84a14f533df82bf2303e9f5194ee3aafcacc
-
SHA512
ca4f8ec8398dfbdb4c2f5179b68210ee166ed1a51799e2e3959a5695bbe056b66a369ad759a9619433adc9122f9cb6a7bbac26c819801b1e364fb66c0b4ed3e3
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFI0t8:6j+1NMOtEvwDpjr8ox8UDEpN/jh8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_09a84db49f44727f1cf6b5582a448463_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_09a84db49f44727f1cf6b5582a448463_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5d139f7b77276510430a209828d6d2e55
SHA185c2afd42ebb6dfb0c06a07df0660cfbcb151ba3
SHA25604d7f68bf3be545645223c3417721d5bed82e3da778f24ed896df9abd5b8b633
SHA512863da7d14793302b601745472c400e21252eb802ef7b973f65ac8c1748da87238d6b90e79303441931cad605192d777edbb4611b9aef8f5c04aea9cf18018439
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB