Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:18
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe
-
Size
52KB
-
MD5
ad478df1fa4bfd1ad9514e5fb8eb2360
-
SHA1
d7be79151ae830b853a8e3e67683d3d26ffddd88
-
SHA256
7c34455a41f96525ae68e7a1009e41a6daba13147b8296efbf398d2b085cd80a
-
SHA512
da64ca6f7da6293e568d9913d1eb1aecdad2efdd5dba396655729f5492f5a86b0311f4fcb6ad0021706c69db49b212cb5bb467ea34f176b3771d93592e7e838f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRY+iyys:6j+1NMOtEvwDpjr8hhXy+iyys
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-1-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_rule2 behavioral1/memory/2704-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2308-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2308-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-1-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_set1 behavioral1/memory/2704-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2308-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2308-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-1-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress \Users\Admin\AppData\Local\Temp\misid.exe INDICATOR_EXE_Packed_MPress behavioral1/memory/2704-15-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2308-16-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2308-26-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
Processes:
misid.exepid process 2308 misid.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exepid process 2704 2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exedescription pid process target process PID 2704 wrote to memory of 2308 2704 2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe misid.exe PID 2704 wrote to memory of 2308 2704 2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe misid.exe PID 2704 wrote to memory of 2308 2704 2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe misid.exe PID 2704 wrote to memory of 2308 2704 2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe misid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ad478df1fa4bfd1ad9514e5fb8eb2360_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\misid.exeFilesize
52KB
MD5ff149804f78c92e6f82754ec9823fb7f
SHA1bdc3461a50458ddcdaf1293a588791dd31357933
SHA2562d18d53864905a1d0c7315f9f1abba4250169d9cb68d03a273bf245b544fcd9e
SHA512928850298b80527e3beb78fd9429743039abcc72fbfbb91277d8e12834870b4c2d52af5438ccd5f256c4b9ba6480bd47bfb97be2ffbe2d82950e7fc32bc110f7
-
memory/2308-16-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/2308-23-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/2308-18-0x0000000000450000-0x0000000000456000-memory.dmpFilesize
24KB
-
memory/2308-26-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/2704-0-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/2704-1-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/2704-2-0x00000000002F0000-0x00000000002F6000-memory.dmpFilesize
24KB
-
memory/2704-9-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/2704-15-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB