Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/06/2024, 02:38
General
-
Target
2024-06-11_d574c561ef816012afc6a5a5aa29db07_cryptolocker.exe
-
Size
52KB
-
MD5
d574c561ef816012afc6a5a5aa29db07
-
SHA1
e172bb399913874efe4a8ff182a25beda01e6998
-
SHA256
0842072b0269cb6d78e74ca3b210080e3cf5ffdb602d9340a6bc5ffb93a73294
-
SHA512
cd82a46f25b852a6a2420fd85a175b7dfaf3e1508676c1a1ddadf532ac8fe37c4cff618db4acd82d058e5daf3451b22c87de8161c6a5ecc06924ef188a140c8e
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRY+iyy1:6j+1NMOtEvwDpjr8hhXy+iyy1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_d574c561ef816012afc6a5a5aa29db07_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_d574c561ef816012afc6a5a5aa29db07_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD59ff51fe90dbae1aa20bf955174053878
SHA115b2d86d3bf928150a95353849dae7d79e3be96e
SHA256a1bae635e81302ccd7f99db1d5cb8f518b7e45d751503737784d32f168959d6e
SHA512c7e30f0367d7d7bdd1c1d4a233e64f694c86bcae5b94fe1e7edc6d0ebf4877d62878d68dd0ce569525525a5a292fe6c2305eceeff148e9c55d1c1c61369a9b88
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB