Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/06/2024, 03:22
General
-
Target
2024-06-09_05994d4cb436986fbe85ef08c9ce3b30_cryptolocker.exe
-
Size
56KB
-
MD5
05994d4cb436986fbe85ef08c9ce3b30
-
SHA1
28a152f41ac1f62f300b482aad12cd5ece0def11
-
SHA256
7957dafd60ff346fe0a52622005cf38a52ce8e0a0fa215b070ed7d767bba2034
-
SHA512
d5646c767b9f13122d1d562441af9cf40c96334cc48e86ea64c80a7c0131c04964954614c9e76b059c6cb91d8965cef2587114d370eb48c84de0cdb337f2248f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e6B:6j+1NMOtEvwDpjr8oxExe6B
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_05994d4cb436986fbe85ef08c9ce3b30_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_05994d4cb436986fbe85ef08c9ce3b30_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5a46558d5ff430b4660f1d6098621f802
SHA1203ba75c7f3e1c03936861f9696f286a08af6415
SHA256874abc953d19d62c22e34f2e1add9145008b280e475c7d6d052039a6bb78a2c7
SHA5122dc59392bfb3b04aa494dd63595da1176cf954da5176891a11a253b8f427b228b8e487ff50adf9f81f5188cfed2c3899b08416036a9d906a55afb38d947dadef
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB