fb18ed7a89ce39d4367185bbc93e4c03001fea18c66fea7ac2c979cb3b796d32

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe
Size

126KB
MD5

7b7d9cca320e8fdb58aeb4d52be9b5c0
SHA1

f930dec1459dff4ce7a5d9b917a7311b216b648d
SHA256

fb18ed7a89ce39d4367185bbc93e4c03001fea18c66fea7ac2c979cb3b796d32
SHA512

e5e6bb4a534c3fd7c0ba47ba86e687745f521d34a5c2b99e621c3ca4f9d22b05bf61d5876b1a0877115b9c15e2c687a2d6c39dcc505ce2c2e797c7b4357055a7
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//Lz:vCjsIOtEvwDpj5H9YvQd2RR

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012253-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012253-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2920	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2920	1972	2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe	28
PID 1972 wrote to memory of 2920	1972	2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe	28
PID 1972 wrote to memory of 2920	1972	2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe	28
PID 1972 wrote to memory of 2920	1972	2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_7b7d9cca320e8fdb58aeb4d52be9b5c0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
2ff88d249c9e98291fa5d2e4b2565a99

SHA1
5ee0f9eaf832dde86a2d28281dfbe9062aa76369

SHA256
fb122234ae56a4e434c4b0eba5ae5d57100fda2d8cd1b45d4994879439bfe595

SHA512
71ba965b755e7d4952ef2e03dd16b33a0b3350b1fb5edcf122b911a596ce8234eefaddf39bedecafb1d7471938f13c0a9a5fb6170a3194c793aae08a4126d212

Download Submit
memory/1972-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1972-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1972-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2920-16-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2920-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download