Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 02:30

General

  • Target

    2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe

  • Size

    50KB

  • MD5

    fc1b336f8ef460da34b774ab710935e1

  • SHA1

    977736ae4c23c7ad7c2f54f56e9ebd4695055cee

  • SHA256

    8688092cb3f0b430d9b8ef1c37ca4b501e8e527fbe371704f0cf8d2a0e66b31d

  • SHA512

    0d192550fc2775bc33da2b432c50b6ae645cb7097a1fc9c155c1e5a7afe87347765755e32e9a8f15501dd18f2a540403ee5241c6a71e8e91b8cb1bb660b4941e

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rva/yYsm06Mq+:xj+VGMOtEvwDpjy+viHs7pV

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2972

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          50KB

          MD5

          3058ed1418b78790d07a84e8c3b618bb

          SHA1

          cc4cbbddb463c90436b63b3444958a87d20c9cea

          SHA256

          7d65a16451af71e91725c04e13a39f54df322d62488d555fa44fc31f59a34fe6

          SHA512

          5d7776b5fddb0f0c61835c8e524602f6874353baf4c5b30366c195bd608876d3cd0d5d21ac2c6812e50ab772f8c342d1ec8fcfa155ba7bd5d360aaf3103657b4

        • memory/2056-0-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2056-1-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2056-2-0x0000000000280000-0x0000000000286000-memory.dmp

          Filesize

          24KB

        • memory/2056-9-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2056-15-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2972-18-0x0000000000460000-0x0000000000466000-memory.dmp

          Filesize

          24KB

        • memory/2972-25-0x0000000000420000-0x0000000000426000-memory.dmp

          Filesize

          24KB

        • memory/2972-26-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB