Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe
-
Size
37KB
-
MD5
9c32043945c14bf722a616b20d363315
-
SHA1
40e766102d3c71a38095a2717e94c2f7956206e9
-
SHA256
df17757463bd06997e7cd581d5074cfa0853c9b7e73a37141fd62ba4f50208bb
-
SHA512
05356ce32f5e952eefc659c76a355c95acabef4d3d74f5dfd20f603913883f1dfbe775cd3a1fdcf3572a29f4208a3a79ac9c990778c5f0a97df28efb70864f65
-
SSDEEP
768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4XWf:fT+hsMQMOtEvwDpjoIHmf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000015d0f-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000b000000015d0f-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2336 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2868 2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2336 2868 2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe 28 PID 2868 wrote to memory of 2336 2868 2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe 28 PID 2868 wrote to memory of 2336 2868 2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe 28 PID 2868 wrote to memory of 2336 2868 2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5f01014a0db36fed854cb70168cb8e72a
SHA185ee74d002bde2c6595f1c40fd2b353deca8126d
SHA256108ce0f8f1cc5a3483e160ae3d751b9a95c5041ed6524ecefc146938858df61e
SHA512e8cf1d6e1aaf0bc56702b2574a8a5a13d43292e311297a536a2ae806acd92f3c15a57a8e95a595e3df52e5e78d433616f2b72e92fbaa7c52f2aac1166c4d38cb