402da60593d95bd28e183c5ca8371b7c118104953a3c0e4fe251ef1f82794440

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe
Size

80KB
MD5

5c9c6baa4f92daf3f823c26ea8b31437
SHA1

5c3f214b9043f2c90656cce09b19748276e35e49
SHA256

402da60593d95bd28e183c5ca8371b7c118104953a3c0e4fe251ef1f82794440
SHA512

85f6d6d7c82c9b74afc33e9db2bb26a67f95ac17ad1918db00c8814c00f7bc0757dde6114d36a3c1810a3d56a552c9c46be49eac2b2f06e117e6f85c3133933c
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAb:TCjsIOtEvwDpj5HE/OUHnSMY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001225d-11.dat	CryptoLocker_rule2
behavioral1/memory/2340-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/888-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/888-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001225d-11.dat	CryptoLocker_set1
behavioral1/memory/2340-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/888-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/888-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
888	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2340	2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 888	2340	2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe	29
PID 2340 wrote to memory of 888	2340	2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe	29
PID 2340 wrote to memory of 888	2340	2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe	29
PID 2340 wrote to memory of 888	2340	2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_5c9c6baa4f92daf3f823c26ea8b31437_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
689265f4932ebfd22a8c1f038b0e7cf7

SHA1
a6a72a04be2c8aa7cbc441e81b30d5a4707e34b0

SHA256
ba0602f8b718fdff3467534c28f346ba7136a5484dd3deb745123ebff0b78aa1

SHA512
8ed202e9df5699535eb419808aff486ca93ca92dbadeac84a4003866cc11d46523d57e72b664b994e28052c756cd3be998f3b86b5687b2498f76f6f871c9723d

Download Submit
memory/888-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/888-20-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/888-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2340-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2340-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2340-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2340-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2340-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download