Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 20:47

General

  • Target

    2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe

  • Size

    42KB

  • MD5

    db252a3273c6795016a5ca48af0173b6

  • SHA1

    fd67198dce0bec0ae73f47dc8a0e05c9a587a2ed

  • SHA256

    7e66758e6793ade7b1225eef814347c97b07a3007ffaae4ad98ec8e5e44c7839

  • SHA512

    6273ebd48424f71ecbbbcb3e12b9f6fd31ad1f6435d6ebeaf4dbda0505882364ebd7330ab12aad5cbd73aa3ebbfd3b1ec4975c1425a4a290d5852f46e5209fed

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKajni:6j+1NMOtEvwDpjrobi

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • Detects executables built or packed with MPress PE compressor 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-19_db252a3273c6795016a5ca48af0173b6_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    42KB

    MD5

    612b59cf6f2f3cd5e8bc64c750645685

    SHA1

    d055c3fbbdd2d4a7e254dc855370f4999befe95b

    SHA256

    f385fcaa6690556d3cb2fc239ca80635eccf8f12a295e83947e9bf8d2f3755ef

    SHA512

    0a37a10e707453b67fefda22c2c0faa955306881031170d6e21acee0cd925f3ba54a0fb9da4e81c857c34ac41bb2b1d661a5521579c63550a717918eb2c5741c

  • memory/2552-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2552-19-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2552-21-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2552-27-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2952-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2952-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/2952-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/2952-9-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/2952-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2952-13-0x0000000002AC0000-0x0000000002ACF000-memory.dmp

    Filesize

    60KB