399710648cdeaf38bc231e35eec854335c05957d6672334bf6556dbf27e0d457

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe
Size

80KB
MD5

d718c73cd070134f71f269befca8766e
SHA1

fee6c8842aee38913618778d04ff8c573ae9b605
SHA256

399710648cdeaf38bc231e35eec854335c05957d6672334bf6556dbf27e0d457
SHA512

4f7eaa7688ddd983224b85d63036447b8c715535a7d766541812b035498590ced13e890a4906da4e86e2588716828e796dd7cdfdbfde53217c98118d0e89c150
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHFQ:vCjsIOtEvwDpj5H9YvQd2S

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a71-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a71-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3012	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
952	2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3012	952	2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe	28
PID 952 wrote to memory of 3012	952	2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe	28
PID 952 wrote to memory of 3012	952	2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe	28
PID 952 wrote to memory of 3012	952	2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_d718c73cd070134f71f269befca8766e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
ec682a83ce4b880df2083e5568ee79ef

SHA1
9e283e4fdee3a7e35469f631ed139beff56fc16a

SHA256
01ac870a391ae49614427276d904ebd81a7f01ed601ce332a83d0f99d89b53e5

SHA512
d64f0e5ea4f140eea7050cb7da654d56567e0c1b8ffc00a1aeb3bd065fb49049ffb6327a26ea09c8a8921e7ccf9a189aae10a4152ebc0fc4681191b8f4781be8

Download Submit
memory/952-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/952-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/952-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3012-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download