Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
08-06-2024 19:55
General
-
Target
2024-06-08_24bdc77e529582b9de31a0ef45f230a6_cryptolocker.exe
-
Size
47KB
-
MD5
24bdc77e529582b9de31a0ef45f230a6
-
SHA1
b7add75ee1c3e6d732cfcb11ed8a1c0cb7366088
-
SHA256
d18250621dd5a55ec36ae6ebcc710c07e219d861cfa1a91d9a1219e7f63d8c89
-
SHA512
2b5e974104628793104d3753f4c6b9336bf525f735c91f5aac867dddf09e1f35e15e990f67c48f52984f8f7c5ed4047c165cb35c0f7660b524e26c9147a85662
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhwl/:xj+VGMOtEvwDpjy+TRhQ/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_24bdc77e529582b9de31a0ef45f230a6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_24bdc77e529582b9de31a0ef45f230a6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD53382208e0ab1e62e6fe6a78d465913db
SHA1b95f2c156cdd317bff42af32e18faf413736ff11
SHA25687b167f738ae6204a9eaea4a6bd2fca63c7a41c0e03280d508905bc3396bf4a5
SHA512db55d0a085e7878ed4283bf96633a3b0f3e1f631a1e2f5bdbe8da14a7ad32dbf043d9e461b46260eae62dea1c1642b3780081fbb04a0be6b9499bcb7dc2c6f18
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB