Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe
-
Size
62KB
-
MD5
8e4e26f511c95373b1181f2f1b6143f3
-
SHA1
e38d533aca72d2f5f504379b695f3a2ab11bcaf6
-
SHA256
37f8c77c5c10b367963787cbc06a5eeb091f0e8c679a9e8ef2a149b8865dd0d0
-
SHA512
0b986558234a3ccd1f3226ef5a5cc52d1e93deab6c9adad158239970763002c2280402d9ddc1133f8d134b1e4ae52447d233f54f48be9f8c5adb9b580ab2694c
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMNuSK:TCjsIOtEvwDpj5HE/OUHnSMZx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_rule2 behavioral1/memory/1920-15-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2600-24-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_set1 behavioral1/memory/1920-15-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral1/memory/2600-24-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
misid.exepid process 2600 misid.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exepid process 1920 2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exedescription pid process target process PID 1920 wrote to memory of 2600 1920 2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe misid.exe PID 1920 wrote to memory of 2600 1920 2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe misid.exe PID 1920 wrote to memory of 2600 1920 2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe misid.exe PID 1920 wrote to memory of 2600 1920 2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe misid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_8e4e26f511c95373b1181f2f1b6143f3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\misid.exeFilesize
62KB
MD52ce303d51c632c50f7c53adc7e443e3c
SHA1ac2e00723f6bcba9a8d9aca912a64ef1e59845df
SHA256359fcf75c6e5c37259d599bd9d046ba26494fa0bd739c635df36b9365e6f8298
SHA51234f54c50ffc6e1a0c2448cbe020c8b16b5716845a0dce7a4b84b06632b31cbd8c4a49fe0603b293e947edc668762a2a35e3b48252dd25188af7a1356e16d4d32
-
memory/1920-0-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/1920-1-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/1920-2-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/1920-9-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/1920-15-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/2600-24-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB