857b7620aac415b4ca6a38bee06c609a813a92ff1c97f1631e5fdbd96ef6a601

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe
Size

59KB
MD5

7086304e6325702b8c2a5878b7f0bb4b
SHA1

1a514d05d7f430348c0f5213f683be19d271bc84
SHA256

857b7620aac415b4ca6a38bee06c609a813a92ff1c97f1631e5fdbd96ef6a601
SHA512

7484baf9ed83179da2faaa112921c5c826af7cacdceadeee6cf455d5763879114f11397686330068d6c8b4ba5d278a71c9afc10be9f672497b2d60ef0b267eb9
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPv1:TCjsIOtEvwDpj5HE/OUHnSMYa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000015cfa-11.dat	CryptoLocker_rule2
behavioral1/memory/1760-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1104-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1104-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000015cfa-11.dat	CryptoLocker_set1
behavioral1/memory/1760-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1104-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1104-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1104	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1760	2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1104	1760	2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe	28
PID 1760 wrote to memory of 1104	1760	2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe	28
PID 1760 wrote to memory of 1104	1760	2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe	28
PID 1760 wrote to memory of 1104	1760	2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_7086304e6325702b8c2a5878b7f0bb4b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
99d8ca40db6fecdd960e5ae1c92a4dd2

SHA1
eeb4323e538b237dd495ec83804e8deb7a17920b

SHA256
1b50cde180e5f1311f6eadd5f28e61ea895e92b95c2b7315352055ea4a016cad

SHA512
0cfd963c016074dc4c7bf9b596c45bd220c4140c9dcf50e8b9db2164824e82eb2018a69e86e64e4d1c5c991052500471f296d3a2393497900fe4e900cad2d1b3

Download Submit
memory/1104-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1104-19-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1104-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1104-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1760-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1760-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1760-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1760-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1760-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download