80a977eeb676c3c4a3cf2966e16f367a3b230812d2046c8d4fe75ee93116dfd8

Analysis

max time kernel
139s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe
Size

60KB
MD5

fe996133f004a0838a15578f3417c7c6
SHA1

92204c4782bf56b4dfb5498e25b0bd5a36614b4d
SHA256

80a977eeb676c3c4a3cf2966e16f367a3b230812d2046c8d4fe75ee93116dfd8
SHA512

d6de8f57cec710e5f25ff206cd0a5f7c2895d4843edd613c75c34e62607c4f2824c3497677a6ee94a26af0ff05a56c403682868d461783a47c985d7818ccc5ec
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIg:TCjsIOtEvwDpj5HE/OUHnSMq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0008000000012248-11.dat	CryptoLocker_rule2
behavioral1/memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2716-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2716-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0008000000012248-11.dat	CryptoLocker_set1
behavioral1/memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2716-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2716-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2716	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2716	2040	2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe	28
PID 2040 wrote to memory of 2716	2040	2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe	28
PID 2040 wrote to memory of 2716	2040	2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe	28
PID 2040 wrote to memory of 2716	2040	2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_fe996133f004a0838a15578f3417c7c6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
ce1abdad7df648da7a8a1125b2df7cc0

SHA1
faa71285911b13077c8233252ba6585d59c34c6d

SHA256
779294fa6d265767f313cb7c232b311aefd547ecbbfd6367c87120dbc0501727

SHA512
9835b8e62da1b4e125f8220543a72edcc3446622e5cc6c4eaafd138754bbb54ff6c3bc84ff959c60ebdcf310de84d786ad54a1dda46e832f6bc6e2b8f86585a1

Download Submit
memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2040-1-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2040-3-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2040-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2040-14-0x0000000001F20000-0x0000000001F2E000-memory.dmp

Filesize
56KB

Download
memory/2716-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2716-19-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2716-23-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2716-27-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download