Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 11:58

General

  • Target

    2024-02-19_e622baa6b4c3f2f9dc79cbadc2f55724_cryptolocker.exe

  • Size

    54KB

  • MD5

    e622baa6b4c3f2f9dc79cbadc2f55724

  • SHA1

    efd661cd13cfe564312cadf02ffa660539bc0102

  • SHA256

    fb65b10fd176f7b8dd8e0cc40470da5c240902d82d46c6b62be46faaaf23429d

  • SHA512

    3e2ae6562d45d270c47b8f8e7adbf8f498e35fbb4fb19223603fbc9d793afd23392480d87bb5a2c3ac2947f85276b69422694a1e29d6c87905f799abf072e2e9

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7H:6j+1NMOtEvwDpjr8oxEZ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\misid.exe
    "C:\Users\Admin\AppData\Local\Temp\misid.exe"
    1⤵
    • Executes dropped EXE
    PID:2448
  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_e622baa6b4c3f2f9dc79cbadc2f55724_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_e622baa6b4c3f2f9dc79cbadc2f55724_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2380

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          54KB

          MD5

          c881a28f21cd804e5aa92a3bdaa44268

          SHA1

          70ec3c3a7bc711cd9078f264860d5f09aa070a6e

          SHA256

          5bba279722bd2b86784b3e877420453d8e48dcfffbc61a26fa6f2acf4793559e

          SHA512

          9e9469e03f32747a7999278526a3fdf641598d3ea380087737486ada5ea86c0ee372ed851e737c8b8e9eb57e072c7d3eb85b155ce4bdd8e1b7441a1b4b420a1c

        • memory/2380-16-0x0000000002800000-0x000000000280F000-memory.dmp

          Filesize

          60KB

        • memory/2380-15-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2380-3-0x0000000000270000-0x0000000000276000-memory.dmp

          Filesize

          24KB

        • memory/2380-2-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB

        • memory/2380-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB

        • memory/2380-0-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2380-27-0x0000000002800000-0x000000000280F000-memory.dmp

          Filesize

          60KB

        • memory/2448-26-0x0000000000320000-0x0000000000326000-memory.dmp

          Filesize

          24KB

        • memory/2448-19-0x0000000000450000-0x0000000000456000-memory.dmp

          Filesize

          24KB

        • memory/2448-18-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2448-28-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB