Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe
-
Size
43KB
-
MD5
abfd823b807f1b111100d22ea53feef2
-
SHA1
be9926514cfd06e172800c28b814a14f51832021
-
SHA256
c217a640e278bc350f27ec00c12e0e5d47ffff44dd38553d75c1089a918e6e5a
-
SHA512
2d34c4eeb402e33760471a6ccfce0f173dbcd6a7de7a62c97005bd92417d5a85d7cb5837c54fdf5dfb255ca1d899e3bbda9104d69cb05d38079a057b9ccc128f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aDDRG:6j+1NMOtEvwDpjrRsG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/1708-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000c00000001342e-11.dat CryptoLocker_rule2 behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/3012-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/3012-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/1708-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000c00000001342e-11.dat CryptoLocker_set1 behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/3012-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/3012-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
resource yara_rule behavioral1/memory/1708-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000c00000001342e-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/3012-16-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/3012-26-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 3012 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1708 2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 3012 1708 2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe 28 PID 1708 wrote to memory of 3012 1708 2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe 28 PID 1708 wrote to memory of 3012 1708 2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe 28 PID 1708 wrote to memory of 3012 1708 2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_abfd823b807f1b111100d22ea53feef2_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD500973b40741ef0cde90aeef1bd33ea30
SHA1ecd9efeb8f3c54674658d60a159c114d5faf024d
SHA256f616fbf3fe06d37f694bd39d7516f764b8bf4a06fae399d8c6ab7b1d52854ac4
SHA512e7b64c9b187b1ae02c507da5eb8ea06cb6ef81c5d0edacd8dec32e0296a0f40f119b2fc4510cf88488c43995d6c9801e73d95155290c89d8615ffde66df9026f