Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/02/2024, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe
-
Size
47KB
-
MD5
bfc6b238922c6c638e30269753b9f4d1
-
SHA1
8ee2cae1b74465d075e26f554f106f84c110711b
-
SHA256
1c0eb6bd694c5e0d4752ab6df91c81e85a90101d8e6a63a29fe997861a10ebd6
-
SHA512
e38912f0e5dd3888961eafb6c48881f2ee710cf2531af2902a4539dc2720d272823756e16ecee063f44a92bad6c86695a39483d7735a22b385e4804b9c4ddcdd
-
SSDEEP
384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/7IVthY:XS5nQJ24LR1bytOOtEvwDpjNbP/MPQT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
resource yara_rule behavioral1/memory/2380-1-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2380-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2380-13-0x00000000006F0000-0x00000000006FF000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x0008000000012270-11.dat CryptoLocker_rule2 behavioral1/memory/2332-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2332-27-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 3 IoCs
resource yara_rule behavioral1/memory/2380-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2332-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2332-27-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 6 IoCs
resource yara_rule behavioral1/memory/2380-1-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2380-15-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2380-13-0x00000000006F0000-0x00000000006FF000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0008000000012270-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2332-17-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2332-27-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2332 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2380 2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2332 2380 2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe 28 PID 2380 wrote to memory of 2332 2380 2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe 28 PID 2380 wrote to memory of 2332 2380 2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe 28 PID 2380 wrote to memory of 2332 2380 2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_bfc6b238922c6c638e30269753b9f4d1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD55767c599b5d1cbc04eb5a7f6fa0bb076
SHA1dcc46d7d4efffb457836300e980c225aed9d2e09
SHA256a2b6a0f1e0a8845bc65c4e040e9d5b30392fff845f1650baaa4a4c7f693c317c
SHA51298dd2e49b8e0de5b701702389022e14e28c32846fa25fd322b7f578a941c608e62ebea74013f5dcb208ea68efb82604880dc8c1dc090719d948127ebf4c6802e