Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe
-
Size
69KB
-
MD5
591e76dd1f35231887a39966c2148fb9
-
SHA1
5b032aa85c8a2e3f3c5c2629e8cd896d9e8c5235
-
SHA256
09d5aa573e53136fb60dbd62bf242901248d694afc52ab4c5105f685e7044c4f
-
SHA512
c1e62dec0aaed3d97081bc809e899c2d301f8ee32ae0d1cbd28f49caa88676371fffc2194f01f158ffab4a2c8e2863086e8969f3b607c41e9e83b8d0ce49d696
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dh:i5nkFGMOtEvwDpjNbwQEI8UZD7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral1/memory/1540-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000c0000000132c6-11.dat CryptoLocker_rule2 behavioral1/memory/1540-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2516-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral1/memory/1540-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2516-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral1/memory/1540-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000c0000000132c6-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/1540-15-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2516-26-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2516 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1540 2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2516 1540 2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe 28 PID 1540 wrote to memory of 2516 1540 2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe 28 PID 1540 wrote to memory of 2516 1540 2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe 28 PID 1540 wrote to memory of 2516 1540 2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_591e76dd1f35231887a39966c2148fb9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5f4f111462cc682d01cbf2d22d5f641d5
SHA1e3b4941cd3de94d8669de343416e1771bc9cbf34
SHA2563743c1c52d6db73fc1cabd463faffec1900f97069ac53719da11c18c0b2b7534
SHA51222db08692e08e027e8a3bb1f89fe14e09a5e07f01082b3be8c6566328e90a59edcbf1468273c6861101796ed4f668c352bfa526514dd8377bf9538924bb3c046