ec2443a6c52bae593591b1ca9686ee9a268747b2e3436f76b7024204bac1845c

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe
Size

38KB
MD5

d04b0a4aa0ccc4e58ff177fe640d8970
SHA1

b2bff18cd5dd3e637f68dd29545145e348d258aa
SHA256

ec2443a6c52bae593591b1ca9686ee9a268747b2e3436f76b7024204bac1845c
SHA512

f51328aa00d1e2ab8c3508b368d6e86dd18771d683ce76414710bd8215a9b49787d79350f31df545e7b787276eaecde9d1c5a56b004106a5fc90d48a02963abb
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/UkRYzrB:vj+jsMQMOtEvwDpj5HcSY/B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000143fb-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000143fb-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2884	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3032	2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2884	3032	2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe	28
PID 3032 wrote to memory of 2884	3032	2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe	28
PID 3032 wrote to memory of 2884	3032	2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe	28
PID 3032 wrote to memory of 2884	3032	2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_d04b0a4aa0ccc4e58ff177fe640d8970_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
36ec21c519b2684c166b53980914f2fc

SHA1
36fe9e8e61bb2a8cae692ca83057392449a6527c

SHA256
f1261a3622f42ea608f543b2007bb94373a2a4ecf34640207b72f996900a5f36

SHA512
5a2c30b00b57f00236406cd426f9842ded6cf2fa6dd8072fd3561f62e4cd9e7ffe675476d159fcc3b54f8f8ab014c32578a3ad6cb651f533432c930b9707a69e

Download Submit
memory/2884-15-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/3032-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3032-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3032-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download