Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
-
Size
43KB
-
MD5
64fe9fad41d1ad9155251aa498ed7083
-
SHA1
71dd4c26dc514e97f8c95d86ad4f87c31ea4b835
-
SHA256
011e185ccbc67d85bef765555f0ab87755f53adceafda7650998d4a1a4044974
-
SHA512
f3c5a889359657d86f8506181305c83a8ddf4794b19471f813ea6de95c57616ee4f66019d42a3eb61e43c8e3a616c2dd57a5f66e2fc859deff269105d5e88d5b
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1n9V:m5nkFNMOtEvwDpjG8hgpY19V
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
resource yara_rule behavioral1/memory/2972-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000b00000001227d-11.dat CryptoLocker_rule2 behavioral1/memory/2972-13-0x00000000006D0000-0x00000000006DE000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2972-17-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2700-18-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2700-28-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 3 IoCs
resource yara_rule behavioral1/memory/2972-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral1/memory/2972-17-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral1/memory/2700-28-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 6 IoCs
resource yara_rule behavioral1/memory/2972-0-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000b00000001227d-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2972-13-0x00000000006D0000-0x00000000006DE000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2972-17-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2700-18-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2700-28-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2700 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2972 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2700 2972 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 28 PID 2972 wrote to memory of 2700 2972 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 28 PID 2972 wrote to memory of 2700 2972 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 28 PID 2972 wrote to memory of 2700 2972 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD518db5ba22fe538129b87b48f23cd90c8
SHA132bb6fc10ef0d2c18a8c04c7ece576f76b89d4df
SHA25601485005ff54b281ea74ef3c76060a7e6bd00552bfced1c23e69ce14b3cc01a1
SHA5123eb7a22ee50415c7faf67ce019f05d751cd5714eadbd1f562a0fc827df03d0abc693950981580221226a8a8eb51a5a61190779ba359a2e2f96ca83bc09a56de9