f0c448a467ea908d41eb7b3253c1f515942e01e2527efd6b48b38d5f22db1cc3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe
Size

64KB
MD5

d1a42c1584e9d276db2932281e6f5d81
SHA1

b61bb31e7cd372e30eebfff846a9f976d364558f
SHA256

f0c448a467ea908d41eb7b3253c1f515942e01e2527efd6b48b38d5f22db1cc3
SHA512

476da466108b1c205cc81a7e70adc600923c18b71f5af3d772c5137212c3c8da1c48fc6866363d03d11305e0c4a4a5d523d014da0d79b9a2d6fc739dee398ed6
SSDEEP

1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1knzhF:vCjsIOtEvwDpj5Hv0j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000133a9-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000133a9-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1684	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1684	2892	2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe	28
PID 2892 wrote to memory of 1684	2892	2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe	28
PID 2892 wrote to memory of 1684	2892	2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe	28
PID 2892 wrote to memory of 1684	2892	2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_d1a42c1584e9d276db2932281e6f5d81_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
64f2f915cd760a91b25f5daa91514c50

SHA1
c9a6c6fe52a1a71127a10e79c26e0c9624c862bf

SHA256
c4e47c76caea1d0153c262ff62b6b1aea55c34457d4ba51245b45a037707fc64

SHA512
69bb1227bc3743e45021d7eb0d385e8c55fe4ab2b540d0e61d6eb5acb225d64c0558bd1144984e92cebaa622a4a98bbc96e79c66719d71e38fe237b807820ada

Download Submit
memory/1684-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1684-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2892-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2892-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2892-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download