e8c7051e744937fa4cfd58094eecf08bc104a35f3b481d23cb6ded612cab1689

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe
Size

41KB
MD5

9299488547f09406acebb81e75867318
SHA1

64b5b7d6defbfd9654a4993a5ace511080fd54a7
SHA256

e8c7051e744937fa4cfd58094eecf08bc104a35f3b481d23cb6ded612cab1689
SHA512

3eaa251c9fd865cdbadfc88b95f67e88ccabdeb5c5f286a6cff6783ca5176a867916e3b66a33e4c8b72d9e03405d8b0a4dfb651b8dc17ceb99c319887be14b34
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66T1:vj+jsMQMOtEvwDpj5HW5s1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2972 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe

pid process

3056 2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2972	misid.exe

pid	process
3056	2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe

description	pid	process	target process
PID 3056 wrote to memory of 2972	3056	2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_9299488547f09406acebb81e75867318_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2972

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
42KB

MD5
1a386bfc4355cd3cdc4ef0488355fa63

SHA1
79fb4874265bdfc32e3b44093f4e24da5ccf263f

SHA256
61dbccddd91f8994d3b8a7f4b02ab8ca41ab456833c0eedb59bd245e8067c55e

SHA512
19b3e167642dbb3b22653691526624983344571b212b15c7d55735b813f35fc3c254ebc6cdb7e97bd669e1f173dd7531e81912a0583390258269fe767053ef39

Download Submit
memory/2972-22-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2972-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3056-7-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download