Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 10:42

General

  • Target

    2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe

  • Size

    71KB

  • MD5

    95b6e7c88ac17a92a43a02732c3c639d

  • SHA1

    30246a7677305c04fffb04b8d773e6a030b49c58

  • SHA256

    5dce237ad2d285c8b26e797b4170adb33f34aa98ecbedae4436b56b2847da905

  • SHA512

    2352ae13d52d7cf2d7901ca3edca139f985984d94409e4c311957613f5c5a68d97d39a4fc46e62caaf0a63b6a44749eb053913d45e845bb4b8e508d913f0ffde

  • SSDEEP

    1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs95h:C4Q2c94OtEvwDpj4H8zi

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 2 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2796

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          71KB

          MD5

          489edcef5d30325d312d1e78ab28fba4

          SHA1

          6d77f5f7dfaaf7c8a8c5d8992a8967c1a5bf4d5d

          SHA256

          bb178fbf9462525418eef36f8a6bb07726163b693f31cf5ab389d57b988828a1

          SHA512

          9dd3709d95ed634f7f257b23d62ed37516d2c5f43986074ecebac1cab752dd447d163245087241473842bc0a99e0e383f005a04f8b0894b85c29d253af14fd69

        • memory/2340-2-0x0000000000290000-0x0000000000296000-memory.dmp

          Filesize

          24KB

        • memory/2340-1-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2340-0-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2340-9-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2340-16-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2796-18-0x0000000000280000-0x0000000000286000-memory.dmp

          Filesize

          24KB

        • memory/2796-25-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB