Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
14/06/2024, 08:14
General
-
Target
2024-06-14_df93989d29d8e3524012f2aa2113f5b6_cryptolocker.exe
-
Size
43KB
-
MD5
df93989d29d8e3524012f2aa2113f5b6
-
SHA1
74e5a93c91dc6ccd94e62250d25f0f391f470bcf
-
SHA256
8537c1236275b31b2bdc629d95df6c467819791b22ae0c891fcc95c59bcd1572
-
SHA512
fabde8d44d7a239d68ec6a4dbb1b81d0fc4bed9387473c1d82c5ef92862f8901088074fe64dbb399167c1ef0e1d759bb4db3ffcabb0218429f739a252cd64fab
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZnTV:i5nkFGMOtEvwDpjR+viHs3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_df93989d29d8e3524012f2aa2113f5b6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_df93989d29d8e3524012f2aa2113f5b6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD50f0c44b48bfbb4e110351ec2c0f96a20
SHA19222edb886fa548ad386f98efe4993619bdb9672
SHA2562019b052023f64fa8a0ca3f446f71122fa3abb597cd37dd453309a2244cd477d
SHA5120498c29e6eb22808ac6ad280d728a8bbabf08e6b7c71d7fe54c05830fe740e08aab38912f394a11665cd176e9bb8d254c18211e70027a1c54f1761fa1c26b867
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB