f71c753e6a85d59e3f6243d557892b96da677c11713b567f819fd63645f6951c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/02/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe
Size

125KB
MD5

df0ac49b573f15d19c8a8cf308508e77
SHA1

3722c132934f58021448ef04f71add0d1e1f1250
SHA256

f71c753e6a85d59e3f6243d557892b96da677c11713b567f819fd63645f6951c
SHA512

f21449f69c82035d631177cb4ec30f0bb45c73577ea6b7803018c40dccb1cfdc68e6b7085f36e1ab585254fd8104dde37f9e1d0957c5c3e709d2df929fcffea4
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpMa:vCA9OtEvwDpj5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012248-13.dat	CryptoLocker_rule2
behavioral1/files/0x0008000000012248-10.dat	CryptoLocker_rule2
behavioral1/files/0x0008000000012248-22.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012248-13.dat	CryptoLocker_set1
behavioral1/files/0x0008000000012248-10.dat	CryptoLocker_set1
behavioral1/files/0x0008000000012248-22.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2700	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2700	2876	2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-11_df0ac49b573f15d19c8a8cf308508e77_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
19KB

MD5
cc75b0bf16c09ff7f17cf8d3ccc679f3

SHA1
400c90b174b46f0ac1afe11942b6816a1b8c9979

SHA256
7db80ac9dcf235fec9b9a3196880b6ac21fa16fd2c325bc458b446276a19a518

SHA512
95d3ba5c91046fd1898e7832a6c583eeacab3c713a4309565b3be51ba830f2c460f14782bcfbc09416b1a432082314f6b2c92a84733b1249fc5974e22ab12a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
fe8ac11e208eac3529a1a7d060242a99

SHA1
2de43f78aafde4c3f5ba35bda7927a593d42ef98

SHA256
f7a1169b5c737486faca5623b155e7c9be6d02c0242a991492e126290ed68c95

SHA512
b5e4082476aca81da440a20bd2b2d4e00cffa7651bba63b1fd5468eafcd11f58654f2ba6595d0406ba0c55f1a52a88583d2f984527d79dae40a45bb6eb3d33cb

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
91b739b995aa79793109adede12f0be1

SHA1
b03c34f7a48971a8f19f1373d2bc5d72cb14bcfc

SHA256
a16cbca632f620bcec2030516ffb34760b75d3c02a98a4a80621627d050d0f4c

SHA512
8f46afe73f5e09898527e2c78c1be35c44702780401fedfa19d27fbe847494ccdca5910efe18e09ab9ff4779fd3ddcbf4d44e7d7aab0d1278a54e6490c5c2519

Download Submit
memory/2700-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2700-20-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2876-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2876-1-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2876-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download