d05e9aafd866443ab8325067a34021d2fa6254581b0311a1682467c840f23d5a

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe
Size

82KB
MD5

9742cb059bedd93c08d8754fe883bcb3
SHA1

f29ab6d5c7b24a9d868b9709973ed11f1db4d713
SHA256

d05e9aafd866443ab8325067a34021d2fa6254581b0311a1682467c840f23d5a
SHA512

f27c2d8f25655b7e5ca8abf4a22bb9cac621bde3593e472b535e32014502816081831ca811f061ab9f8457c7bb905a25d69a0f2fbd5b04b624f6f966e7afe8bb
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAe5o:TCjsIOtEvwDpj5HE/OUHnSMQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001224f-11.dat	CryptoLocker_rule2
behavioral1/memory/2524-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3004-23-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001224f-11.dat	CryptoLocker_set1
behavioral1/memory/2524-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3004-23-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3004	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2524	2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3004	2524	2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe	28
PID 2524 wrote to memory of 3004	2524	2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe	28
PID 2524 wrote to memory of 3004	2524	2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe	28
PID 2524 wrote to memory of 3004	2524	2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_9742cb059bedd93c08d8754fe883bcb3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
2e5724050a09f70cc49afb39f49241e1

SHA1
22915e19112c2d6aa8daa2c75ffb2fa410c40755

SHA256
d56ddf9f30e7bd369358d96f471ad78ea4cf4bc85bde3f5935b1523a17aa8949

SHA512
a6bdfe5a81ba323fde33cfe0e52b6dcbcca6cedd110c844235f49f33ed5a131e393c45f5b5f7522569b7c149fc972a6dcfb6279c3b011997491fa9095f573207

Download Submit
memory/2524-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2524-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2524-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2524-3-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2524-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/3004-17-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/3004-21-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3004-23-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download