c8487f03fe6f1cd0e0225966ee99ba78c69b50fa8cf841d179479b70d378e578

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe
Size

126KB
MD5

90996069556a0933380be077300b65a1
SHA1

748e1efb267a23410a2fd4e7ec8bcd63304e64fe
SHA256

c8487f03fe6f1cd0e0225966ee99ba78c69b50fa8cf841d179479b70d378e578
SHA512

776989f45d5fb6ecb3f25a82e7137c8aa88c862e46be5c854159152ce2ea3a49fb688bc9b3231be1797de865218f625911310678807fcf172d3ac363b0a1ad18
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpJ:vCA9OtEvwDpjl

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000139e6-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000139e6-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3000	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
880	2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3000	880	2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe	28
PID 880 wrote to memory of 3000	880	2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe	28
PID 880 wrote to memory of 3000	880	2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe	28
PID 880 wrote to memory of 3000	880	2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_90996069556a0933380be077300b65a1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
77ebb4c193fe499d04f0008588182565

SHA1
7b4a5e3f0114ba657fe0651e307ccbd45608392d

SHA256
a38651abb2c62b35426f0ce570a09113eb56025337da46132e0176d2846e3dee

SHA512
b31f2935bf5f1682059c79a8aad4d95a512854796789e25e4dbff9c19573de6ce0ce85e0f05ed1d3654fc96d42e7a07b5bb62f8ee6ffefadbea86994165382b2

Download Submit
memory/880-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/880-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/880-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3000-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3000-16-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download