54c18d5a7f392c20acf9744b8b991e64ce14b8545c1027e513a151d1cce6b2ad

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe
Size

128KB
MD5

ddebbb2bed88cc53d60a66bf5f8d2b98
SHA1

00ad85636f231d6c14a82588d0e0843fe7ea8aeb
SHA256

54c18d5a7f392c20acf9744b8b991e64ce14b8545c1027e513a151d1cce6b2ad
SHA512

3a852a10e86b926ce919357b06708bb05fd2a5ec0537456be32176b6f12c8e835a34726aecaf70f953d231416996189422252127260bb055fee6eaf17375eddc
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//fRG:vCjsIOtEvwDpj5H9YvQd2RG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2656	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2656	2992	2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe	28
PID 2992 wrote to memory of 2656	2992	2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe	28
PID 2992 wrote to memory of 2656	2992	2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe	28
PID 2992 wrote to memory of 2656	2992	2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_ddebbb2bed88cc53d60a66bf5f8d2b98_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
129KB

MD5
e24e258d752ead733c6e514ae5b2bc2d

SHA1
721c04e48c7164e0873f1d1ff901b83492420021

SHA256
1f2e6b1283bcb7ccad41a039610f67f62f5b90874083b7b6f03629bc7d307425

SHA512
caf9800f6218be75d484c44b15df6845037ebef239b68e0a4653bde92b7161db1f9537da27890509f6625ee50609f435d890014444be194bce5cbf38c23a7838

Download Submit
memory/2656-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2656-18-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2992-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download