b7321d695b6f831afcfc30983c73afc8c2dcd365940623a2047cfb3b9dd3ecc7

Analysis

max time kernel
13s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe
Size

60KB
MD5

1f9adce5e5a2d36665d4cc7f3bbd3225
SHA1

972e961b57bd4f61e142577dfd2a8a227d0cf301
SHA256

b7321d695b6f831afcfc30983c73afc8c2dcd365940623a2047cfb3b9dd3ecc7
SHA512

58f98cc22b355fb33066fee70bd1e664b82b1ed2b480b8bacbdfdb57f8e8f29ef7697bac0c70052646821290d4c803bf7f5f35a12628fa0b78dd2ceee750e815
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIC:TCjsIOtEvwDpj5HE/OUHnSMI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2768-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2768-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x00070000000122c9-14.dat	CryptoLocker_rule2
behavioral1/memory/2804-20-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2768-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2768-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x00070000000122c9-14.dat	CryptoLocker_set1
behavioral1/memory/2804-20-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2804	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2768	2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2804	2768	2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe	20
PID 2768 wrote to memory of 2804	2768	2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe	20
PID 2768 wrote to memory of 2804	2768	2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe	20
PID 2768 wrote to memory of 2804	2768	2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe	20

C:\Users\Admin\AppData\Local\Temp\2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
02742b2189c3c18fc3c347b0a4e57f9b

SHA1
6af114cd21e4e5cd1abb183f74bcdb1f5f097bc1

SHA256
fe1be3000d29802f24f21466f6f8eb66df272e920cc2a8ef3226f13758773157

SHA512
7c9040b531b3c8e8dcce8d8de1e7e14603baf5fc5b5663910d2421a6370796a257effaf1e92e6da87eb4a71d65468a789ff7de7d87dd16ed312a8229278e075e

Download Submit
memory/2768-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2768-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2768-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2768-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2768-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2804-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2804-20-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2804-17-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download