Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe
-
Size
43KB
-
MD5
daef39f24182b3a380eb4901de2bf4b7
-
SHA1
ea51400203c4f8797cb2eba86d06519aaf6bc86b
-
SHA256
c83ab739389de64d0bbe5dd8e31746e7806c996a9d05ad07de6fd898c665ee5d
-
SHA512
d12ba7e05b43c5a9a1f37eb68e6d2bd51867b14073a650cec2883510c11d11b1af23fc4bebe97c296b451d1a88d0b8880c892bdc56b04b954141eee149244d60
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/agqBT:6j+1NMOtEvwDpjrRtq1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2084-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x00090000000122ee-11.dat CryptoLocker_rule2 behavioral1/memory/2084-13-0x0000000002360000-0x000000000236F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2084-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/3004-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/2084-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/files/0x00090000000122ee-11.dat CryptoLocker_set1 behavioral1/memory/2084-13-0x0000000002360000-0x000000000236F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2084-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/3004-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
resource yara_rule behavioral1/memory/2084-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x00090000000122ee-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2084-13-0x0000000002360000-0x000000000236F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2084-16-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/3004-26-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 3004 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2084 2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 3004 2084 2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe 28 PID 2084 wrote to memory of 3004 2084 2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe 28 PID 2084 wrote to memory of 3004 2084 2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe 28 PID 2084 wrote to memory of 3004 2084 2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_daef39f24182b3a380eb4901de2bf4b7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5f1dec24c0d40dddec993b3a2cba799a9
SHA196847f527f792fac1998a2749a1b32d3adbf895f
SHA25692cb6c439bcbd6d9947a31b37e52885e711405a1c263751554fd390a2cac4722
SHA512fc67d88c1ff0e8f74214d640988812085291c4195f599d3a81df8a55dbeda19355ed5cba663397447a4d64818ff80af22494b6e855f6820a65fcff006e62f531