Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 20:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe
-
Size
42KB
-
MD5
db252a3273c6795016a5ca48af0173b6
-
SHA1
fd67198dce0bec0ae73f47dc8a0e05c9a587a2ed
-
SHA256
7e66758e6793ade7b1225eef814347c97b07a3007ffaae4ad98ec8e5e44c7839
-
SHA512
6273ebd48424f71ecbbbcb3e12b9f6fd31ad1f6435d6ebeaf4dbda0505882364ebd7330ab12aad5cbd73aa3ebbfd3b1ec4975c1425a4a290d5852f46e5209fed
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKajni:6j+1NMOtEvwDpjrobi
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
resource yara_rule behavioral1/memory/2952-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000c000000012249-11.dat CryptoLocker_rule2 behavioral1/memory/2952-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2552-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2952-13-0x0000000002AC0000-0x0000000002ACF000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2552-27-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 6 IoCs
resource yara_rule behavioral1/memory/2952-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000c000000012249-11.dat CryptoLocker_set1 behavioral1/memory/2952-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2552-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2952-13-0x0000000002AC0000-0x0000000002ACF000-memory.dmp CryptoLocker_set1 behavioral1/memory/2552-27-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 6 IoCs
resource yara_rule behavioral1/memory/2952-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000c000000012249-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2952-15-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2552-17-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2952-13-0x0000000002AC0000-0x0000000002ACF000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2552-27-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2552 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2952 2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2552 2952 2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe 28 PID 2952 wrote to memory of 2552 2952 2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe 28 PID 2952 wrote to memory of 2552 2952 2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe 28 PID 2952 wrote to memory of 2552 2952 2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5612b59cf6f2f3cd5e8bc64c750645685
SHA1d055c3fbbdd2d4a7e254dc855370f4999befe95b
SHA256f385fcaa6690556d3cb2fc239ca80635eccf8f12a295e83947e9bf8d2f3755ef
SHA5120a37a10e707453b67fefda22c2c0faa955306881031170d6e21acee0cd925f3ba54a0fb9da4e81c857c34ac41bb2b1d661a5521579c63550a717918eb2c5741c