Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    12/03/2024, 20:00

General

  • Target

    2024-03-12_d27aca1c914601d2acdd3e5e90982f08_cryptolocker.exe

  • Size

    81KB

  • MD5

    d27aca1c914601d2acdd3e5e90982f08

  • SHA1

    f503c0984b3c5200c7c6be6dbc1ac3460c708b67

  • SHA256

    e3525c160a945cefc0fc46494bce3ebb959f5ede63bd5e60c0fd7c23df6e077e

  • SHA512

    5381927419ddd0638dc4a7d1e2434fb59cab7227209634a99454ba3bac3fb71567dcf51b416b9cb2b27c8f4f2f693fde67b6c6ed931bfe6fe36085536f26e67e

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMA2:TCjsIOtEvwDpj5HE/OUHnSMR

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-12_d27aca1c914601d2acdd3e5e90982f08_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-12_d27aca1c914601d2acdd3e5e90982f08_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    82KB

    MD5

    a5ae2c7c225024addbfb6bdf7ee15f2b

    SHA1

    264820e9be1ac243d3a80c7d5be13b3aff007410

    SHA256

    e57c3f2a196d614408ae71461189e5d4525ab723c56200d9e122ddc168cfe585

    SHA512

    a3c7bc14097237a799e9fc35b674aa312f227fa457e8bfdef6e8fecad97feba15dc463f69d449bc41583d13b75680bcaeb1a66569f9b4651d98275f94fed7bb7

  • memory/2084-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2084-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2084-2-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/2084-8-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2084-15-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2272-17-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2272-18-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2272-25-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB