Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 18:51
Static task
static1
Behavioral task
behavioral1
Sample
202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe
-
Size
62KB
-
MD5
8e4e26f511c95373b1181f2f1b6143f3
-
SHA1
e38d533aca72d2f5f504379b695f3a2ab11bcaf6
-
SHA256
37f8c77c5c10b367963787cbc06a5eeb091f0e8c679a9e8ef2a149b8865dd0d0
-
SHA512
0b986558234a3ccd1f3226ef5a5cc52d1e93deab6c9adad158239970763002c2280402d9ddc1133f8d134b1e4ae52447d233f54f48be9f8c5adb9b580ab2694c
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMNuSK:TCjsIOtEvwDpj5HE/OUHnSMZx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
misid.exepid process 1948 misid.exe -
Loads dropped DLL 1 IoCs
Processes:
202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exepid process 2488 202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exedescription pid process target process PID 2488 wrote to memory of 1948 2488 202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe misid.exe PID 2488 wrote to memory of 1948 2488 202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe misid.exe PID 2488 wrote to memory of 1948 2488 202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe misid.exe PID 2488 wrote to memory of 1948 2488 202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe misid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\202405218e4e26f511c95373b1181f2f1b6143f3cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\misid.exeFilesize
62KB
MD5e6ff72841f90a001f68d18f53b83067e
SHA13b02ffd4a9979f067251f3d6cabebe3b190861b6
SHA2560170617ccbe97db4fdc085d15dc31f3ce5b0d9fc1af13a47087728db9ff9605a
SHA512183db6da4e029068cfc036e381e7b392f189655dedebc7a9845fcf294c6f67d101bdbeebe8f3eba4ab6a7c713000ddada27cf8bf4c5688c29403adf7d2c00e8c
-
memory/1948-16-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/1948-18-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/1948-25-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/1948-26-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/2488-0-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/2488-1-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/2488-2-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/2488-9-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/2488-14-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB