bd5a80f9cfe737fbb3eb293f4ba0940c499a7601433ab63299a58902a9dacf51

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe
Size

120KB
MD5

3131a22eded390f24e2710bc0235f3ad
SHA1

5a06fa8de94bde9cd419e7fe4ca4ccce6914ea57
SHA256

bd5a80f9cfe737fbb3eb293f4ba0940c499a7601433ab63299a58902a9dacf51
SHA512

d02f19992ae1f2137e123d8c19a64b324798cce4990ca28f86f9ae21c0244db9230084800fad8149b8349be64d6a42c8ac06a22fe8d27b87e4cd6b573442df9a
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTKY:gUj+AIMOtEvwDpjNbwQEIPlemUhYaY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015d70-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015d70-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2384	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2384	2400	2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe	28
PID 2400 wrote to memory of 2384	2400	2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe	28
PID 2400 wrote to memory of 2384	2400	2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe	28
PID 2400 wrote to memory of 2384	2400	2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_3131a22eded390f24e2710bc0235f3ad_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
121KB

MD5
e26027bb4c807d6613c9361ec9efa72e

SHA1
2cead0423fbbaef28482971c7404cda73fce1678

SHA256
f5d17fd77c8cfaf502f2f3f8fe766d9209fe849fd8005aa5d22d6175a0ea15a2

SHA512
1797028a7ee2e5810315839966711825c1cd7ccab356d782c872ccefe043dfd4a908160a1c995529c5cb6bf4832f9a951f0e1afdb38413fee6f23a47f9965ac1

Download Submit
memory/2384-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2400-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2400-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2400-8-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download