27e49cd5d28366d60c2fb75833039e40d2d60c675f468e7c190d3d187308508e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe
Size

124KB
MD5

f06848ad0af2e5723aad695f5ae92551
SHA1

c6b6a6c1138b1095fbf97c82e03d81d36525fa28
SHA256

27e49cd5d28366d60c2fb75833039e40d2d60c675f468e7c190d3d187308508e
SHA512

1f83808d4f5b62acbe17509a69e89d77c72e4cb44ff4a6399120b67b8c573478e3865bc0121cd615799743c727777e9cfcb9a233f902c98d97bbd29b97e59916
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//f:vCjsIOtEvwDpj5H9YvQd2Rh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224f-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224f-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2052	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2052	2164	2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe	28
PID 2164 wrote to memory of 2052	2164	2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe	28
PID 2164 wrote to memory of 2052	2164	2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe	28
PID 2164 wrote to memory of 2052	2164	2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_f06848ad0af2e5723aad695f5ae92551_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
125KB

MD5
1a3930ba84d581d655be7f201c50f317

SHA1
0432cf9bd99b8dfedf0a317d120d113c24ed38a2

SHA256
63b02da8f1e89eba0c3248b4c0c7d2099bd104191cafa9b80bee2227ac32132c

SHA512
ed20449c3045c846355b88c5edd5a56bee245ebfd8b10539520370fcd9f4104057f83649a0a9e3a6653b2d0b88c16928130f62b6c93baefdd4f833afd8cfce6b

Download Submit
memory/2052-16-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2052-15-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2164-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2164-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2164-5-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download