Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 02:29

General

  • Target

    2024-06-11_5a46f698edc2dbf6876bb08e870883bf_cryptolocker.exe

  • Size

    51KB

  • MD5

    5a46f698edc2dbf6876bb08e870883bf

  • SHA1

    70744c6b57e18042caabe28c07310b45d46e822c

  • SHA256

    090f4016f80426f395c3607a0339788ef988cbc73e0b78737b79dd48a6152a14

  • SHA512

    a38c80f394312b1c2d64374901b80893d11acbd3c80c4450af2ee00da507aed2facb608339745b3008fdf004e497fe30f6f1a59a121fd47c7cde9ebb4e8a8b21

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRY+iyyj:6j+1NMOtEvwDpjr8hhXy+iyyj

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • Detects executables built or packed with MPress PE compressor 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_5a46f698edc2dbf6876bb08e870883bf_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_5a46f698edc2dbf6876bb08e870883bf_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2520

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          51KB

          MD5

          6bbcba0a3827e21b00fe5f2cc355ea91

          SHA1

          cc8f40f9b551d0cd834032be60834b9203570b0c

          SHA256

          25b53de36db1bba18d8f13bbcfc97d026b79e336efac1bad00169921736e584a

          SHA512

          53d561e28f6498d70b2dcd1c9b8cb7ff0b6c9c5eeb98a90c12858fead96e8a0c26ed119050d4d5daff9b1afbb0b76bd015daf182e89e2d9603548060314881b8

        • memory/2340-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2340-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

          Filesize

          24KB

        • memory/2340-0-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2340-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2340-13-0x0000000002840000-0x000000000284F000-memory.dmp

          Filesize

          60KB

        • memory/2340-16-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2520-19-0x0000000000610000-0x0000000000616000-memory.dmp

          Filesize

          24KB

        • memory/2520-17-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2520-26-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2520-27-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB