Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2024, 18:00

General

  • Target

    2024-03-06_cec8c3c19bb75c6e6d024be654cb9fb0_cryptolocker.exe

  • Size

    44KB

  • MD5

    cec8c3c19bb75c6e6d024be654cb9fb0

  • SHA1

    ccc54fa84996947bae1e90b13919f1683324c1e9

  • SHA256

    7e3c7606a26072687a50b7d80a1539ed0414c083a9fdb116f70f81c8bbe8761b

  • SHA512

    735750b68a77376fd4e185f701cb31eabe08fc9032576652ee34a29c45a6d3080e7546583749f13edd02cd812bac12fe0a261bc3124ef8511bb40772e973927b

  • SSDEEP

    768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66nkp3:vj+jsMQMOtEvwDpj5HW5Ii3

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-06_cec8c3c19bb75c6e6d024be654cb9fb0_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-06_cec8c3c19bb75c6e6d024be654cb9fb0_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          44KB

          MD5

          4982493102522c3af649e6f3f57ce98d

          SHA1

          3476268890e5d38646532fe115dacf73db866bd1

          SHA256

          50d703cd575522db981e8635a59b8b4832c1416385e8c421f1826d79c326b897

          SHA512

          40a7e71e40de184a6a7c3fdf2d6747d9385c091868d3d1b52ba08651eb32db649272f71352f120fa0ca1417db9aa3fe0b39422f63397068613aba70d4a328ce7

        • memory/2008-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2008-1-0x0000000000450000-0x0000000000456000-memory.dmp

          Filesize

          24KB

        • memory/2008-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2232-15-0x0000000000330000-0x0000000000336000-memory.dmp

          Filesize

          24KB