663d7065693fd9eaa2c910190a9510eb1bd41c8732dbd3a34ba2c3b08e1213e2

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe
Size

78KB
MD5

03741861a5a8df6571698df7c245c76d
SHA1

f3a92aeaa1efca3096dc4730cb72a5a2698daa28
SHA256

663d7065693fd9eaa2c910190a9510eb1bd41c8732dbd3a34ba2c3b08e1213e2
SHA512

55af579ce2c0490a30db731b894159692189f700a06d1f7746e3f33a3b85511c35142b055217f667c5414b4154fdc714e2433e275f2d590c5dae5901bf27b854
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafp:vCjsIOtEvwDpj5H9YvQd2N

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012321-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012321-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2168	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2168	2040	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	28
PID 2040 wrote to memory of 2168	2040	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	28
PID 2040 wrote to memory of 2168	2040	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	28
PID 2040 wrote to memory of 2168	2040	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
6a7dbe240bd8b77da138120cd4bb38b7

SHA1
372f7ef31fbbfda3f404efcd90041874017db84a

SHA256
fcf193f95c595fe4a216703bed7825471a10c6a627112654d5bef9faab257f51

SHA512
6d2dbc44e47882669eefecfeb21012b56cb152d0c92a5d2f8e258adfb9791af90250c60b61d0706c9cddb44c599ebce28d5d3ce1d22da1e553cdcd8fbea81d1c

Download Submit
memory/2040-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2040-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2040-2-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2168-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2168-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download