1532e15affae36f809546e96388ad2b2442a79e4f30536579dd58d167f0fc264

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe
Size

121KB
MD5

778ac2f3a84cb2ca3967590c9fec75ae
SHA1

6fce4c34626bff1ed71c2f377cc3379551a68199
SHA256

1532e15affae36f809546e96388ad2b2442a79e4f30536579dd58d167f0fc264
SHA512

61f7bdef0003cb0b7c0b0a0126b9f6eeca195b9cd6d53264af53bc93c9769e7f8a6fb15749deae805de1a2f055b56fa79aef32ec43cee2df43d205e0e1b6f3c3
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTZ+mA4:gUj+AIMOtEvwDpjNbwQEIPlemUhYpr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001227d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001227d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2604	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2588	2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2604	2588	2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe	28
PID 2588 wrote to memory of 2604	2588	2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe	28
PID 2588 wrote to memory of 2604	2588	2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe	28
PID 2588 wrote to memory of 2604	2588	2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_778ac2f3a84cb2ca3967590c9fec75ae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
121KB

MD5
4c028a9599005d57abcbf8cf660f08e2

SHA1
0efd0f0231083ed7470b8068742384dce81703cd

SHA256
7f068596a24f831bea04c25082d07031741090e122decf35629dc25ca70ab56b

SHA512
9b696e2adf3d818af195f9dcd8d6e9536ab97a78c3bfb051d0e31dc04d568502e967074b7137cd528fa1387710a7502d24d8b4c18ced06b4a6d910c56513aee5

Download Submit
memory/2588-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2588-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2588-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2604-15-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2604-16-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download