3eb1a7ca919e860a23febdbb92a69d72ef5ea491519ac18bca97dd05050cfc54

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe
Size

60KB
MD5

dfe18461df15d66973c47294e791d313
SHA1

89736f84471aae11c0846336703907bdf1f547f9
SHA256

3eb1a7ca919e860a23febdbb92a69d72ef5ea491519ac18bca97dd05050cfc54
SHA512

4a16f9536b69fc45b2b4d6767ff5bf86f1b029ab31c2bd749c7252c15b3a45a7e0a48a314e4c62d3ba57c4b8ed67014c767e081647c513aa183be3ec43e4f12c
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9w:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWBn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000012342-11.dat	CryptoLocker_rule2
behavioral1/memory/3028-13-0x0000000000640000-0x000000000064B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3028-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2216-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d000000012342-11.dat	CryptoLocker_set1
behavioral1/memory/3028-13-0x0000000000640000-0x000000000064B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3028-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2216-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2216	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3028	2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2216	3028	2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe	28
PID 3028 wrote to memory of 2216	3028	2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe	28
PID 3028 wrote to memory of 2216	3028	2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe	28
PID 3028 wrote to memory of 2216	3028	2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_dfe18461df15d66973c47294e791d313_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
3a65f0e5875f737168414a47f0cf7ee2

SHA1
8bfb5ada58f5078e6bd504b2591164e6fb1bd48f

SHA256
db87980a3b7007ffbc00aa7d6ad850e6e0258fa50450f0fdd85aba0f76a6a3a4

SHA512
719835161526448a24a8f259c3319526d35b9a7385fb06f8cf17c0c8908f721b27a455c828f3991318dd0d279c49988d3d674ea340715aa028928d198a728196

Download Submit
memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2216-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3028-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3028-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3028-3-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3028-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3028-13-0x0000000000640000-0x000000000064B000-memory.dmp

Filesize
44KB

Download
memory/3028-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download