Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe
-
Size
48KB
-
MD5
5411364013c3ec712d5d743586e3c42b
-
SHA1
a17ce54ef5a62c0fa70ff5199f991f6adec963f1
-
SHA256
830b6d46bc5f26c71ca94ba90b9550a2aa6ebf247437399fa0674148f1e68686
-
SHA512
c0868b831828a00719a5fe814450afe09834086a562206626a1aebd09b82b7e218e53823d7f83f88be934aa6254c8a47dfcec558db559714c5a08a250e3ef8cd
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0n8:vj+jsMQMOtEvwDpj5HczerLO04B/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000d0000000122d1-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000d0000000122d1-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2540 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2540 2292 2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe 28 PID 2292 wrote to memory of 2540 2292 2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe 28 PID 2292 wrote to memory of 2540 2292 2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe 28 PID 2292 wrote to memory of 2540 2292 2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_5411364013c3ec712d5d743586e3c42b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5eceb7e1b73c49b9e4aa9419381c5e613
SHA1d230b7f8f26f747b0f23a943092891ec28997c3f
SHA25679f157fcea97dab7a08cb625ffb350c55c423181e7d03ba6365a42d99056341e
SHA512b41d0bf0c318ffa7784212a39f800c3e4f874c39aca449350b84eab1b124a6fc43493cd349a229fe09b848372188cff93b7a8e344d5ac705893f62004f123cc5