Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe
-
Size
46KB
-
MD5
cd162b4adbad7fe2c96a733c25d6ba92
-
SHA1
2ea117e2feb85db3c384f352d8847efd9b73fd16
-
SHA256
555ccd6baa25b13227d714423a9eb7014da340972ebca184522a940593fa3d5d
-
SHA512
e55cc2bc35a247ff8b82554b85779e325ccf06e9fa3acd9cff956051195f5cc94b40a81b34c2cd0823d30cae4a951948c8f0238f4caee796095b65ff42b74973
-
SSDEEP
768:qQz7yVEhs9+js1SQtOOtEvwDpjxXOQ69zbjlAAX5e9zS:qj+jsMQMOtEvwDpjxizbR9XwzS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000c000000014b27-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000c000000014b27-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2792 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1420 2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2792 1420 2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe 28 PID 1420 wrote to memory of 2792 1420 2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe 28 PID 1420 wrote to memory of 2792 1420 2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe 28 PID 1420 wrote to memory of 2792 1420 2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_cd162b4adbad7fe2c96a733c25d6ba92_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD57b9e623809dd8482eefae302487de9b8
SHA1d57c4dbd3716d8086679da6afc9576be34f7669b
SHA25621fa6291de75dd99de5ae78848a45c34ba48ed35a15c5ca0dbc9d6d52b3df176
SHA51224a6d26429ed072c2e4d69873a43d6e3d7847e964038d521e435c1fc44f159ff2affee362566a17d0dd64696d4b8a2c8450549f3486fed8a3b4d423d86c7661b