ae5c0f2ec6dcbb82716d4d91a243d142442c0c4f8cb6458556d75069acffb8dd

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe
Size

36KB
MD5

715a8b39a64c6450743d4e65db681520
SHA1

eddfc685a41c627772b1213ee1a48ab4b86659e7
SHA256

ae5c0f2ec6dcbb82716d4d91a243d142442c0c4f8cb6458556d75069acffb8dd
SHA512

b6532871bc063bee392ccc5b27ab54f7fa7f35f59eb253df8ec7d2b18a625cf0251a6b1affe1582b3dfa332e64913ef8095155db5a676f37ba7b54de684c73d7
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4+:fT+hsMQMOtEvwDpjoIH+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001340b-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001340b-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2504	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2504	2000	2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe	28
PID 2000 wrote to memory of 2504	2000	2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe	28
PID 2000 wrote to memory of 2504	2000	2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe	28
PID 2000 wrote to memory of 2504	2000	2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_715a8b39a64c6450743d4e65db681520_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
8eb2f12756816695cfc869a12cb472a1

SHA1
a0ef52aa8b29a695830b9e0c2ddcb2e533a326a0

SHA256
aa2edf66cb9f673d2c2695a9b25405d2be0734e46079da1e47e2cf4a9f732267

SHA512
5e62e970222d2e445d7327ba07a465addd0ab2f8dca41189c3f65485e2ec21b43462e68f362be3d0daf4d55e0cc77120f65b5a6f5af3e1f6f573678c8995abe1

Download Submit
memory/2000-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2000-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2000-8-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2504-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2504-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download