b4cc4a940822bd59c467b389c65699528e2ee54b9fee26089a945bca089546c3

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe
Size

61KB
MD5

1c82ce8f80c011315ab967d361bd5c2c
SHA1

1121db7f95f9f8f485a771a494fc8f912df5ecd3
SHA256

b4cc4a940822bd59c467b389c65699528e2ee54b9fee26089a945bca089546c3
SHA512

08e631603e7e4b5f96821be0c584b4debcb0fd03d254b1826ee73857adae54978e8bf5fd6d2ff42421086af4c4392ae29b9f38ede4f06e4c7577d226b362e65e
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG95:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012251-11.dat	CryptoLocker_rule2
behavioral1/memory/2604-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2184-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2604-27-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012251-11.dat	CryptoLocker_set1
behavioral1/memory/2604-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2184-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2604-27-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2604	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2184	2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2604	2184	2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe	28
PID 2184 wrote to memory of 2604	2184	2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe	28
PID 2184 wrote to memory of 2604	2184	2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe	28
PID 2184 wrote to memory of 2604	2184	2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_1c82ce8f80c011315ab967d361bd5c2c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
414f23657a932d4f578951a9d162e1d7

SHA1
de580b97887ca07c6c645b2f513a45ec1eb5341a

SHA256
432694012e8ba204135e350f02b983611e8a71083f4403412f8c6a5c2b59b909

SHA512
caa3f6d99ae1cac3dcefe182b326bf4464bcffe3bf83777e1ca31f3f78db8eb1bf5c793bc57811e2c8b8880209f09ad21bdc38ff65ae0618c002d16a0bb2cc08

Download Submit
memory/2184-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2184-1-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2184-3-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2184-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2184-13-0x0000000000650000-0x000000000065B000-memory.dmp

Filesize
44KB

Download
memory/2184-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2604-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2604-19-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2604-26-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2604-27-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download