Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe
-
Size
59KB
-
MD5
9a6000133533848edf99ad2eb927d1a4
-
SHA1
736a6e2fda031691b56521fbab0db9f85d691c94
-
SHA256
db5eb4c4c39d21f4cbb4fd81a6b1a83149711d47e959433160b709b43575163e
-
SHA512
433c3e11204ff5ebcf2f671c4b9aa83657ad70ba8cebedcd31837c4c7ff85fcbbe3c9ef2db144576456d721e02d0ad6b8ac59243b0a9ea079c24c623d0f58e90
-
SSDEEP
768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XGJ0:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWG0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2204-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_rule2 behavioral1/memory/2204-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2520-25-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2204-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_set1 behavioral1/memory/2204-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/memory/2520-25-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
misid.exepid process 2520 misid.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exepid process 2204 2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exedescription pid process target process PID 2204 wrote to memory of 2520 2204 2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe misid.exe PID 2204 wrote to memory of 2520 2204 2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe misid.exe PID 2204 wrote to memory of 2520 2204 2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe misid.exe PID 2204 wrote to memory of 2520 2204 2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe misid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_9a6000133533848edf99ad2eb927d1a4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\misid.exeFilesize
60KB
MD59eb57f8306b8f648420a648ad691c8ae
SHA19da850ac9cfab98981350e7ae6b91f03bc735f06
SHA2561166821adf7f8de75583c1783bd4a973668311f944d1ac77ff9846e13bef3db9
SHA51216c63b68c2ed2445abcfbad07a4e290f56ad8bb7ed278309db8cca2f29615e785e9505049d1711ca05f5837b129bf657848ca101ca3f309ed94c54cd23c0fce3
-
memory/2204-0-0x0000000000500000-0x000000000050B000-memory.dmpFilesize
44KB
-
memory/2204-1-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/2204-9-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/2204-2-0x0000000000480000-0x0000000000486000-memory.dmpFilesize
24KB
-
memory/2204-15-0x0000000000500000-0x000000000050B000-memory.dmpFilesize
44KB
-
memory/2520-17-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/2520-24-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/2520-25-0x0000000000500000-0x000000000050B000-memory.dmpFilesize
44KB