508469f03086f5bd339fd8399b34aa866a13acdb18d911fff7e0c24ba44c7d96

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe
Size

126KB
MD5

d7a3fde46dcaaac056c67ab4e2d5e5d3
SHA1

5ded03477a538b22ca16f02bdce69d3cec948596
SHA256

508469f03086f5bd339fd8399b34aa866a13acdb18d911fff7e0c24ba44c7d96
SHA512

5e2dea93ebc984430b32cbf3e9088d0c324013c6524d9a28c220d6d3d4efdf3206456d85f6b2cf0c139d0392a284a3be9fc2b11e388088d3d9fca7c200e393b0
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpi:vCA9OtEvwDpjG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2516	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1540	2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2516	1540	2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe	28
PID 1540 wrote to memory of 2516	1540	2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe	28
PID 1540 wrote to memory of 2516	1540	2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe	28
PID 1540 wrote to memory of 2516	1540	2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_d7a3fde46dcaaac056c67ab4e2d5e5d3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
3e75f8bc7f9a6dde68191cdb9d536e3a

SHA1
bb72812fa232381c83255073fe182cf12d5d4f00

SHA256
8a7f2083d728adeba793015124b4fb25c923ba2c39be4402f1c499f885a9b609

SHA512
e7ef1a55ed1757eb23b716b42a57f8fc049312385e402b9e720af0e65da59134a3b4a3adf9035f69b71eec90db366d0abd1edbf1bb8d71d24929d377616ce764

Download Submit
memory/1540-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1540-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1540-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2516-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download