1722a5ddf640fe611c9f8fbec01fabf0eac2e57bf5341f5596d3bbb0ad83e545

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe
Size

44KB
MD5

d415b38804f62fe3e46f4d02888f215a
SHA1

d8aff140143be2722cbab7e30220a26fec2cdb6d
SHA256

1722a5ddf640fe611c9f8fbec01fabf0eac2e57bf5341f5596d3bbb0ad83e545
SHA512

6adbd06d1c048121db02119a08b863d11b1ae796dc8f1c9de622268e4ac073eb349a0c4ca0147681c3016fde8a56f5d90d7be56ad0322210ebadbc0376a1d441
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66nkpS:vj+jsMQMOtEvwDpj5HW5IiS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000126ab-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000126ab-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2532	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2864	2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2532	2864	2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe	28
PID 2864 wrote to memory of 2532	2864	2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe	28
PID 2864 wrote to memory of 2532	2864	2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe	28
PID 2864 wrote to memory of 2532	2864	2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_d415b38804f62fe3e46f4d02888f215a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
6876247106a0548718f2458af1cbbffa

SHA1
3c46eb37d58052ff2284ecc5f845d7b82a5add93

SHA256
5d98b48009b5bb998c17dc8a2242e80b490a4a3125f009723a0fa8ef537b7176

SHA512
84d75c8aa49326ee38f2306afeb89775e20101a4742d0a7df88007726ba832e84dd4fae3e5b90c744f1bc2698ae431be6979c0266c2a259c9676b0405e72c714

Download Submit
memory/2532-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2532-18-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2864-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2864-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2864-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download