badceea85a1e672d55515928ba0f4e3e97e6612343999bf77d78bf7966494c37

Analysis

max time kernel
0s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe
Size

68KB
MD5

d740d9f89731160d7a3277b7a82e308c
SHA1

073568cd92b07eb4e6709a7143f7b437dc1d4430
SHA256

badceea85a1e672d55515928ba0f4e3e97e6612343999bf77d78bf7966494c37
SHA512

48966c9d4fc42a45314bd563826f41efdd93639aacc957904098362fea2b52c181e80460c66fd593fea1080d6aeeb4cd82db69d7df5640736c5f4117dd41f94a
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/R3:vj+jsMQMOtEvwDpj5HZYTjipvF24VQO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-21.dat	CryptoLocker_rule2
behavioral1/files/0x0008000000012262-13.dat	CryptoLocker_rule2
behavioral1/files/0x0008000000012262-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-21.dat	CryptoLocker_set1
behavioral1/files/0x0008000000012262-13.dat	CryptoLocker_set1
behavioral1/files/0x0008000000012262-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2956	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1224	2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2956	1224	2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe	17
PID 1224 wrote to memory of 2956	1224	2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe	17
PID 1224 wrote to memory of 2956	1224	2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe	17
PID 1224 wrote to memory of 2956	1224	2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe	17

C:\Users\Admin\AppData\Local\Temp\2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_d740d9f89731160d7a3277b7a82e308c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
2KB

MD5
f2e77edca8a3ab2111640471ca5dc6f3

SHA1
0080e5ee97ac918793fa95b16ef5876b7c5ab784

SHA256
0cbbef5c437c4960fc11c8eb46859f0b44f6fe937fcdf5ced2352de4465864ef

SHA512
f231ace15995ae3dfb85e5944adba85852d9250ccd51031ef9cb51dd7cf6c2b030af7c98c110cd9bd5443996089f94ced9ffa4a113f375732ffea162b3490f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
20KB

MD5
7d430966cb3db0b81b2cb885251330dc

SHA1
cd6d543c4edacd53ad1a870ddfaa08d9ead4a5c8

SHA256
3bd1d623a751e828bdd9822c7341f67cf761101507422b7479bed1598a4935f5

SHA512
b5dbf2b7cc1b3c5ebe62974be4a7f8c371be7f7b9b31c7ca02da6236a467e66f284a6423e983c2f9773c18cad15101fd83fe65514f16fe7e3cc028c8a7e4abf9

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
23KB

MD5
c094535865d8317f969b4e5692d5260b

SHA1
88e1b6298e733ccfd2a5cd2e6088ff13e3931530

SHA256
d4b33a26eef57c2c34e8a5f0912de5ad21cd1940bb359f459dde79207a91caea

SHA512
d5fc8e144cf3d65bc0fdfb0bae0f8433d6365d220cdd58d81468d39a9132a24932ccb1eb5cd0366706f537efcc9d6f890426a2f7a51c44537a1a13c88c5bff33

Download Submit
memory/1224-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1224-8-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1224-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2956-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2956-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download