d326512091124613741f1ad80062cfb29e93e832691e85b0ae03216469b0c509

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe
Size

47KB
MD5

5370c95a8423d9f954d2dc80d4ce08d5
SHA1

a66a7deb4ef9ed4521e707381e0d902670788a1c
SHA256

d326512091124613741f1ad80062cfb29e93e832691e85b0ae03216469b0c509
SHA512

75f8f707ab7f450ef7e885ff26ce88466f0622f25582ec2f3d8bba6558a13aec6cfaac93ec2e9dc97c6b20ab042a9414e33a4f959dc87d3cc5e2f37bb88abca5
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsk:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ12

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-14.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2652	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2948	2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2652	2948	2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe	28
PID 2948 wrote to memory of 2652	2948	2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe	28
PID 2948 wrote to memory of 2652	2948	2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe	28
PID 2948 wrote to memory of 2652	2948	2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_5370c95a8423d9f954d2dc80d4ce08d5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
7d383761570bfb2b42b228201ddcd225

SHA1
d492fb5d444641c834875145e27a79983e68e9a5

SHA256
d67c4b5ec30cef664f55edbd92b787ff1cf18bb641268f6eb51b953ffc56762f

SHA512
5162e02211d9123b84a0bffcb6078255dd06144afd80301c481dc00d94f86923c8f615c28dffd18b6512a6e4f3faf0624f7d623582fe34a6c9463bf7b01c4020

Download Submit
memory/2652-16-0x00000000020B0000-0x00000000020B6000-memory.dmp

Filesize
24KB

Download
memory/2652-23-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2948-1-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2948-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2948-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2948-9-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download