3810972d8b4eb65a2817be67cd4fdab083fa0ab6eda74e31b530c0e8048c8273

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe
Size

125KB
MD5

04dbae0c273141a34f19361791c62168
SHA1

f1bd40b9f6140953317b938fdd544538f741b65d
SHA256

3810972d8b4eb65a2817be67cd4fdab083fa0ab6eda74e31b530c0e8048c8273
SHA512

47f2d1382cbf460a66eeddb0c90a941422e9f014c3cc832ec13f56345e14b58c4023a866d9c4611f782162587341dbabafbea975810f8fb40224733bb6a422f6
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//va:vCjsIOtEvwDpj5H9YvQd2RI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a21-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a21-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2996	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2284	2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2996	2284	2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-20_04dbae0c273141a34f19361791c62168_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
125KB

MD5
5e49eb59bac88ab4aa48d369eba81ea8

SHA1
ae2eea2a599c760128198e2e16c119eec1cf6fbd

SHA256
f0e7125bba41cc208e86d02b12357d79fc7b9c804fa6718df28e7cf2d8fefdf9

SHA512
ed397fad6cd59981a9df8fa42c54adba964f05502c9da46a9a6d20ea950832ef7f6601bb1e7bfa407593f534c559463e9664b4a4aa55b66bee89e6686bfb6f30

Download Submit
memory/2284-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2284-2-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2284-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2996-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2996-15-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download