5fc7f6fa46698db456e9a0297215ad22e17307606cd54955591cb99d36445161

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe
Size

78KB
MD5

3cbeab91486be18e87c8294302f52ab5
SHA1

023acdfff20a88c7f810dac2c928359011139078
SHA256

5fc7f6fa46698db456e9a0297215ad22e17307606cd54955591cb99d36445161
SHA512

acfc74a9164016780cdde8c368cbaf5a3a5525d0474bd31b577ce8676eb57a33c36be44e7ae212861d40aed4449be5c104cc481fa5bd5ce3c60a4dbf329e776e
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIufL0:vCjsIOtEvwDpj5H9YvQd2k

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2700	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2700	1768	2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe	28
PID 1768 wrote to memory of 2700	1768	2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe	28
PID 1768 wrote to memory of 2700	1768	2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe	28
PID 1768 wrote to memory of 2700	1768	2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_3cbeab91486be18e87c8294302f52ab5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
e286ce1d6be58dabe89fdd57217d120a

SHA1
43553acd17587874ef268e9696ee5b40b6c0bb84

SHA256
09033df2a4e44a1d497083d349b8ca9f7ad197d4621f3eb3ce1e2f420ad16e51

SHA512
c9b3a35de2ed10246aae10567616ec49fcfdd37d7775757604cd237a8088e4841bbc04aabfcc01c469360b2811da86767b744c700680ef7a10f2818f865842ff

Download Submit
memory/1768-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1768-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1768-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2700-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2700-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download