2e41cd9dea404cbbf8a818786dd26be79f22212488e2734368099553ce072d0f

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe
Size

125KB
MD5

b60b43fca58d20de7296cfcb4e1e625f
SHA1

64263680b21e8c22b2701d502a77832a8ba09bfc
SHA256

2e41cd9dea404cbbf8a818786dd26be79f22212488e2734368099553ce072d0f
SHA512

f843432acb52e6a46366960befdbe90d1971a1c18050cf1d65dd64385621ae8f294a5475ffb153a55327440112d8dfa374269e88b2fef6c42b5ce5eb1e2a312b
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//V:vCjsIOtEvwDpj5H9YvQd2Rr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2440	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1664	2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2440	1664	2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe	28
PID 1664 wrote to memory of 2440	1664	2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe	28
PID 1664 wrote to memory of 2440	1664	2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe	28
PID 1664 wrote to memory of 2440	1664	2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_b60b43fca58d20de7296cfcb4e1e625f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
7ed10e1a39de9dcfb741ebe7499c7221

SHA1
8a85a64b519bcbf691d36d4a1429e682309965a6

SHA256
9755245ac87b09e573ce1f571fb7fdaef079eb9ab34d34793d9a63583161a539

SHA512
8d8094d144f410eedf81c6883fa6322b7f7f36e42090fda8cecaa35f54eb0c57947d010839d51b9c002fe40dcab36b4160db2faa1abe721bf8df3feab8d32a81

Download Submit
memory/1664-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1664-1-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1664-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2440-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2440-20-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download