c561f80002ad136b52d172a3debc042e964f03ef64ec154034fe49a5330e2c50

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe
Size

81KB
MD5

128994025a42e017ca371977047e6084
SHA1

2abcb56d8f5496ffe9e601a54b05640d5c7c719b
SHA256

c561f80002ad136b52d172a3debc042e964f03ef64ec154034fe49a5330e2c50
SHA512

11e4c9a5c7d0d7b84f2cc310254f351c211a17b0963cacf1a097531b8363ec19efe1a56a161403783c74b52e46305a38c43142af793048b518c88d17c5f78509
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrl:TCjsIOtEvwDpj5HE/OUHnSMP

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1556-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000900000001223d-11.dat	CryptoLocker_rule2
behavioral1/memory/1556-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2820-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1556-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000900000001223d-11.dat	CryptoLocker_set1
behavioral1/memory/1556-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2820-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2820	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1556	2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2820	1556	2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe	28
PID 1556 wrote to memory of 2820	1556	2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe	28
PID 1556 wrote to memory of 2820	1556	2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe	28
PID 1556 wrote to memory of 2820	1556	2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_128994025a42e017ca371977047e6084_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
e7ca4a4ece9fdffc2eeb9d141b4cdc88

SHA1
2cabe916b76c4c038f78ef686b2afb4e63fc64e2

SHA256
bc7393ac50084464e56b31c3aebc1aa6ea2e880d9b4f10e183265425ea5e1388

SHA512
0ec05a271ea38a8908d7f8f7e69e0903cab0e51003e2be6f8deb61ddf79cbf3d9c056de02ef24871a6b34a3ae0d6f55fd14702db577929f91651dfd35b040280

Download Submit
memory/1556-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1556-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1556-3-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1556-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1556-13-0x0000000002800000-0x000000000280E000-memory.dmp

Filesize
56KB

Download
memory/1556-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2820-18-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2820-20-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2820-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download