14546dd3f82cee78280c24b7ba5c3ed37ace0f2177eae3ef01bd609d1d688688

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe
Size

49KB
MD5

3cd104fcbdaa90f4349317e84d5a2beb
SHA1

7dd17d42ac4ad7d121aa36d6d265d28285a9331f
SHA256

14546dd3f82cee78280c24b7ba5c3ed37ace0f2177eae3ef01bd609d1d688688
SHA512

e3d85a652e691dc98a183151196ac6f49abf9a179a695afb217b27bdaf1ea0832a973f5c82b4da1a75dd0af0b81f003d85e2dd82275b20c0d91a91595f10588d
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUuuMT8MWAN:vj+jsMQMOtEvwDpj5Hczer5ixuMbWAN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224f-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224f-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2732	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
832	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2732	832	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	28
PID 832 wrote to memory of 2732	832	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	28
PID 832 wrote to memory of 2732	832	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	28
PID 832 wrote to memory of 2732	832	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
49KB

MD5
7fe27cd501a45ed94155b10f87ab70b9

SHA1
523aa6b48f0958fca1ce0790facfa92f4f577cbe

SHA256
ce85fb88eccd9d694e0a13e7037a16dbafe841ab6a66c7277efd637cebe9a885

SHA512
b47e80454a9b11cb3f96057fbbffd05fe71a122dbd583ab85ccef073ede0d7770c99d3782c99d1e5d39eb1016e6a17c678a7adebf9299a9b124ee41bd5b36c3a

Download Submit
memory/832-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/832-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/832-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2732-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2732-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download