Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19-06-2024 19:39
General
-
Target
2024-06-19_7b55fb701eb7c0e83a6681cfd04c84d3_cryptolocker.exe
-
Size
56KB
-
MD5
7b55fb701eb7c0e83a6681cfd04c84d3
-
SHA1
90a2ad5768c72c7c7f1570098fc0ee85b9b96909
-
SHA256
f4fb07b67c938e4c375998662a577351ca20d89404ac8f710dd03b9047902394
-
SHA512
7b7a924204419681d9120f8b3b812889d522b8810fa372a8ec82f4597bb13e1ec12c94a961acd07686bc1c2474bc674a383968459f412fcdebb812c35ed3c676
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/eUi:6j+1NMOtEvwDpjr8oxExet
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_7b55fb701eb7c0e83a6681cfd04c84d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_7b55fb701eb7c0e83a6681cfd04c84d3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD58802520501b257a0b0a1726afb9e2571
SHA1e27d1ad6739fb9135c10ec209763287ad18f76e5
SHA256107a1ef03f67833bbe4e6946dd1b391466f4c9fa9b9c11f4c9136aee27c2d98f
SHA512168405d829f8d13926a63d79a7e172ceb92b29c1155bc87710af812348bb7e55dfeb23be3b5550c5bbb21404693ead264b606b123529ed0b7d1f0e172242a14c
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB