e4f3dc698e938f1ef3d3d43ae9a501a25275da5c5f923280c6844bdbfe96fa08

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe
Size

62KB
MD5

89e11e8fa5568a525765ffc8c541abe2
SHA1

21f5fa24ae96d6ac8135f1e721f96fb447a0bd42
SHA256

e4f3dc698e938f1ef3d3d43ae9a501a25275da5c5f923280c6844bdbfe96fa08
SHA512

2cbd4293012b602eefe71c82e5e67f9440d102fe8ef6b21f4b87c86eb7615d6a28faa5181038636ef9bca37e020812884dd54cc987a2dae3ea9b1c705db64830
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvBuP:TCjsIOtEvwDpj5HE/OUHnSMY3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1628-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012256-11.dat	CryptoLocker_rule2
behavioral1/memory/1628-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2532-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2532-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1628-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012256-11.dat	CryptoLocker_set1
behavioral1/memory/1628-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2532-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2532-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2532	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1628	2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2532	1628	2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe	28
PID 1628 wrote to memory of 2532	1628	2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe	28
PID 1628 wrote to memory of 2532	1628	2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe	28
PID 1628 wrote to memory of 2532	1628	2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_89e11e8fa5568a525765ffc8c541abe2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
7899c58395026dbb16ab6110491724d7

SHA1
b540e8a1c89caa059c44f0481e44b39c6fc8c765

SHA256
5d767504d3cc4e3e6c3a9684270513ff93a97075649cdf2a1f5eedde3a63d3a2

SHA512
c210e82b06f24fa143434362301224e6ddb6499c77b9c9efc463b54f98b176b5bbed9eabbb689aa13b4409c01ddb520ec1e2cb28ce444aa01673ff4be1102c74

Download Submit
memory/1628-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1628-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1628-3-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1628-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1628-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2532-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2532-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2532-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2532-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download