3351fbe40b2160621cd877f5bd1851fd298fa8dedb1e36354d42940d89d66d1d

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe
Size

82KB
MD5

cd9f8bfab15163a4c4eca1648ec8e57a
SHA1

810cd02fc1084a6e2e1cf1c0fceb00561434529f
SHA256

3351fbe40b2160621cd877f5bd1851fd298fa8dedb1e36354d42940d89d66d1d
SHA512

0ae2595fa3f740c387146db83680ecb0d0b4e0ba3c144e848a020aae7fd3550fbd7e6af6b4860e65f1077dbc5041761a525ce1e3a39f965c22c7df67fadec000
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNB0K:vCjsIOtEvwDpj5H9YvQd2/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012267-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012267-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2028	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2028	2992	2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe	28
PID 2992 wrote to memory of 2028	2992	2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe	28
PID 2992 wrote to memory of 2028	2992	2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe	28
PID 2992 wrote to memory of 2028	2992	2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_cd9f8bfab15163a4c4eca1648ec8e57a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
f8a563d63bce615bb404a61bf1c45723

SHA1
f12015442ed44b5602aeaa4089d124a62817845f

SHA256
514a6b4357e99a7696388fe6e678412b57dc7233a358ca70a2b0cf250773b532

SHA512
3b139802c32cc06b4270c86fc98b5f2cec3c9793605ab4f3d989cedaea9d8e35e380656cd34b9754217c75ff65d03193822d61c00d03bad26c98465d9f806d05

Download Submit
memory/2028-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2992-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2992-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download