62ab4d0ce4f081b07780e320be35103340327ca684b3a03eb0d51047d9e4a34a

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe
Size

55KB
MD5

0d1d3c8d3ba1ea486287073c689b39d8
SHA1

a283257f1485ce1aeca3b2f2c52da7b0afe57693
SHA256

62ab4d0ce4f081b07780e320be35103340327ca684b3a03eb0d51047d9e4a34a
SHA512

48b0892628eb06a2c2b8ecb2b4734931ae55f01cebfad346d8bffbfe1855e65dd555c5b2ff155b35879340fb15423a853a1509d06ab2817cfefe7be4a44f1a10
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFv6dlr:vj+jsMQMOtEvwDpj5HH1nw73KOFir

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224e-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224e-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2784	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1692	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2784	1692	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
64675db51f3202e26296ea4af80472cc

SHA1
e607b92c6c42157b8153c8af5419f027553a5367

SHA256
a075e47c833ba714d1d333d51e195ed223f27851c8891b119281196c7d735c1e

SHA512
e950da3077bfa8a67d0092500a0fe69d7743b7bb5d9487527af8dfa08a7bfdc944f1ebf14d3a2c1ba80da43f99fe3e47ea906c72d1b36cd4baeeae409512ca4f

Download Submit
memory/1692-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1692-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1692-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2784-15-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2784-17-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download