88b024dd7b45b48d2cfad1d8ad35592f8a4b210b682cf56d4fad4faa6834a222

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe
Size

64KB
MD5

e8e690dd58955915d779309a5781a0e3
SHA1

b7eed20e7c90a1629c25e413411906690dbd9288
SHA256

88b024dd7b45b48d2cfad1d8ad35592f8a4b210b682cf56d4fad4faa6834a222
SHA512

3a45f69f94d355533e933572482241e53faa4992c96788ac8b1961f9eba00416e53b61d833416afb9b919de11587757984fc858b89ad07f9532eb6749654f328
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCY8EQMjpi/Wpi3B3URiLnuoUwUsfqB1S:vj+jsMQMOtEvwDpj5Hy7B3gG8xzUjq+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000600000001208c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000600000001208c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1404	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1404	2520	2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe	28
PID 2520 wrote to memory of 1404	2520	2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe	28
PID 2520 wrote to memory of 1404	2520	2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe	28
PID 2520 wrote to memory of 1404	2520	2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_e8e690dd58955915d779309a5781a0e3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
76276b008a2d3ccd586172aab978d207

SHA1
105d88b5d8c98a6bff135f59769027f97a2805e5

SHA256
0c36c0a1988522a3edf400611fbeec0c64656db3ba9f72e8a9cd30525df8ce2e

SHA512
67b7c8ef23f33a47bd130ae4a8bfc81e8ceb86175ce35e1ac9609e015b3420ef7fa599d324645cc10e2ac7b98a56b759283c8a60f6a24e34ab8517ba922c10e5

Download Submit
memory/1404-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/1404-17-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2520-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2520-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2520-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download