Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 04:38

General

  • Target

    2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe

  • Size

    37KB

  • MD5

    9c32043945c14bf722a616b20d363315

  • SHA1

    40e766102d3c71a38095a2717e94c2f7956206e9

  • SHA256

    df17757463bd06997e7cd581d5074cfa0853c9b7e73a37141fd62ba4f50208bb

  • SHA512

    05356ce32f5e952eefc659c76a355c95acabef4d3d74f5dfd20f603913883f1dfbe775cd3a1fdcf3572a29f4208a3a79ac9c990778c5f0a97df28efb70864f65

  • SSDEEP

    768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4XWf:fT+hsMQMOtEvwDpjoIHmf

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_9c32043945c14bf722a616b20d363315_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2336

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          38KB

          MD5

          f01014a0db36fed854cb70168cb8e72a

          SHA1

          85ee74d002bde2c6595f1c40fd2b353deca8126d

          SHA256

          108ce0f8f1cc5a3483e160ae3d751b9a95c5041ed6524ecefc146938858df61e

          SHA512

          e8cf1d6e1aaf0bc56702b2574a8a5a13d43292e311297a536a2ae806acd92f3c15a57a8e95a595e3df52e5e78d433616f2b72e92fbaa7c52f2aac1166c4d38cb

        • memory/2336-15-0x0000000000310000-0x0000000000316000-memory.dmp

          Filesize

          24KB

        • memory/2336-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

          Filesize

          24KB

        • memory/2868-1-0x0000000000210000-0x0000000000216000-memory.dmp

          Filesize

          24KB

        • memory/2868-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

          Filesize

          24KB

        • memory/2868-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

          Filesize

          24KB