6117d8d7fa10e252db2471b2370a553cabc2485a006efc534a091c2d3144caf7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe
Size

52KB
MD5

d0384da9a20ca9fbf103107fcdd5bd9e
SHA1

f1b1106293d0b1d1cb26c3e3e3191e68d2eb869c
SHA256

6117d8d7fa10e252db2471b2370a553cabc2485a006efc534a091c2d3144caf7
SHA512

183e6869928d70b3cd4c84e7bf6187b94a08b2e341e2117ef24331572718c5fb7cea27e24b9df7672d46f68b3e61e6eda9d5304cffcfb7513387c17d8c056a98
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFv0itg:vj+jsMQMOtEvwDpj5HH1nw73KOFsiu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001232e-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001232e-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1052	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1052	2512	2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe	28
PID 2512 wrote to memory of 1052	2512	2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe	28
PID 2512 wrote to memory of 1052	2512	2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe	28
PID 2512 wrote to memory of 1052	2512	2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_d0384da9a20ca9fbf103107fcdd5bd9e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
d1d805d3011a141a5ea54dca75f2d239

SHA1
794a78178cf87af1332c8f4b7decc576ab5f7dc3

SHA256
3ab30cd33d96285d5f92eaf7f9eb2ff64aa27c76d005dce2ce7f063f99de2fee

SHA512
6ba6281686599dad3025123b88b6ddafea8926027ec3cd1ec8752584ad93d3827530be7bad2fd1a1605d642790894f4f57659218f10fa72a8144eceee5da3f3c

Download Submit
memory/1052-15-0x00000000020B0000-0x00000000020B6000-memory.dmp

Filesize
24KB

Download
memory/2512-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2512-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2512-2-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download