16fd1039b5f30d2d37bb62519b364bd4ab03362a8223e80e4ad3904e494f0acf

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe
Size

122KB
MD5

2a90288fe510a9141c55a7ea53887c3f
SHA1

cd8ada49be7cef5705abbdb916b53b54bc26027f
SHA256

16fd1039b5f30d2d37bb62519b364bd4ab03362a8223e80e4ad3904e494f0acf
SHA512

be4569a385027ba7537747f567e2522b4ecf0033c39faeb75aa9d3118d099ecaad639c49c93b8554322a7bb6d2d64f52a2b1016e7b8008881067e5cb9153baa3
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTKryE7:gUj+AIMOtEvwDpjNbwQEIPlemUhYaWE7

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012281-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012281-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2432	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1916	2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2432	1916	2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe	28
PID 1916 wrote to memory of 2432	1916	2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe	28
PID 1916 wrote to memory of 2432	1916	2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe	28
PID 1916 wrote to memory of 2432	1916	2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_2a90288fe510a9141c55a7ea53887c3f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
122KB

MD5
13e5b9774ca3b31dbd3ace658f1f3c5b

SHA1
acf46371cc17f2c294ee6814a6fdbe2f669ded97

SHA256
aeae5f3fdd9b31234d06cc6c76aa4bc0b17f189e944068ee44ff2e1ea6eac2a0

SHA512
41d5a6bf75675a6f498065c74267af52cf74622a3984cbf94f5eed7103eb8a78a63abef7d213925c1da27494eaa95f9b4a56491c22340a67d2f9160f019121cb

Download Submit
memory/1916-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1916-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1916-1-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2432-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2432-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download