172e6e3b1e09fbf8396949de05409a8703e386d57a45c9a1e6543b7742e25189

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe
Size

59KB
MD5

8cfbc2bb39c4249f621b90d02ce47940
SHA1

a58ae19e2b462f1ddefe05c6d01dc9e741195887
SHA256

172e6e3b1e09fbf8396949de05409a8703e386d57a45c9a1e6543b7742e25189
SHA512

d46b18cbcb184dd38d4fb8649c6a15d7be452333bec00a7c0587801db4aad85c8f996491136142ba7b3f44fcc172e35f3aabf60d4b904891bdcd47d410bbc6d7
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTI1:TCjsIOtEvwDpj5HE/OUHnSML

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2828-1-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000012337-11.dat	CryptoLocker_rule2
behavioral1/memory/2788-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2828-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2788-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2828-1-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000012337-11.dat	CryptoLocker_set1
behavioral1/memory/2788-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2828-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2788-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2788	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2828	2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2788	2828	2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe	28
PID 2828 wrote to memory of 2788	2828	2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe	28
PID 2828 wrote to memory of 2788	2828	2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe	28
PID 2828 wrote to memory of 2788	2828	2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_8cfbc2bb39c4249f621b90d02ce47940_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
a542188ff77ffe7ff3600bba3bf4f064

SHA1
43b4f9d0ce13b3d302104a6ace22c53168563d99

SHA256
b2f09174cab1a9d38a5cd36eebcb9a2d4cc333d98c3e8e150f2d7150d965e9f9

SHA512
88445f60ae44ba18e4388668dd5ca7f8358af3bbdb4f4a7694358f82917f9749f3b7094ee95a0dfb4cb29ee654ea76bc0e34066c3728abe306f3666173b49a76

Download Submit
memory/2788-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2788-18-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2788-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2828-1-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2828-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2828-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2828-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2828-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download