c231820a2db6058f1c0fe391073668e7f31dd2c9d583a22dfdc8d01a4e7b74a8

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe
Size

126KB
MD5

2a40fa40708c23b7de6f3bfb71b3be63
SHA1

d2b6a1fd4734897aea96d903ce65b2af480b4d1f
SHA256

c231820a2db6058f1c0fe391073668e7f31dd2c9d583a22dfdc8d01a4e7b74a8
SHA512

3c03740ff577f9bc558052c3096194058c09e8cf0650c3e24913c1f65e20a73f91a15bba829b35cf6e8cbff1dac4add4c26323266503c6afdabf377b35f72f02
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBxr:vCA9OtEvwDpj/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012247-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012247-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2264	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2744	2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2264	2744	2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe	28
PID 2744 wrote to memory of 2264	2744	2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe	28
PID 2744 wrote to memory of 2264	2744	2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe	28
PID 2744 wrote to memory of 2264	2744	2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_2a40fa40708c23b7de6f3bfb71b3be63_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
f984e03c422fa7d508ad6675b03dd341

SHA1
4b0fb85d206492efb57f3ca2dae6204f1ca70ce2

SHA256
76723fd77ed076b00fa19e030fca16ae3ade12972847a6893f4e36b98d269c32

SHA512
3284f1ecc50d8107923aebaa652a72f9a330a3594bca6fcd94f9eafd3e605fa51b3206440cb1bf8e843a3d13d46e2a6cb6bb76de450bbcfa262c4c771a0615c8

Download Submit
memory/2264-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2744-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2744-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2744-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download