63f3eb38c263513ee77e35e151c8ecf00c16fa8893c88735ad884848a1f497dc

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe
Size

70KB
MD5

52afd2e3ca8b114944b96923159a10a5
SHA1

e1ea9b90104ee5446006617cb7a593f5944c4cfc
SHA256

63f3eb38c263513ee77e35e151c8ecf00c16fa8893c88735ad884848a1f497dc
SHA512

f7d2cc8c64f56e6dda244ca797f6a1d2c559a078016691fde3c93237a08223e7c6bb3faa78bc56e194f1d2a3eba6f4c399d35d5497ce3c98394daf1a89e1efb7
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4wYPsED3VK2+ZtyOjgO4r9vFAg2rqk63Ygx:vj+jsMQMOtEvwDpj5HwYYTjipvF2hK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014120-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014120-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3000	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3000	2380	2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe	28
PID 2380 wrote to memory of 3000	2380	2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe	28
PID 2380 wrote to memory of 3000	2380	2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe	28
PID 2380 wrote to memory of 3000	2380	2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_52afd2e3ca8b114944b96923159a10a5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
d201ba88a326093ecb6b43d9db39b689

SHA1
b16402f46cb8d62accfd6bc7cfc960b1fe00e653

SHA256
8618f19fa747849de158e4dbca69997134d06c19c566c41520d91f29e4c00111

SHA512
ac3a1a6d7ecbafff26b737bcf04da9f5b3749eec508a86780f56458dd8ca5382eb6f4b66f98a89a05791593c35f8173301c7122ec7301c0ea7430042ac955e03

Download Submit
memory/2380-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2380-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2380-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3000-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3000-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download