3dbf8e3356a6facc7bae8706e9669db4cb9fd014fd0030208d658b0397d15f4b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe
Size

37KB
MD5

17aa9bc80cd46e19daeba94d874463aa
SHA1

4aa63634d3b58b45693aeaceaf8ddcd9dfc15ff8
SHA256

3dbf8e3356a6facc7bae8706e9669db4cb9fd014fd0030208d658b0397d15f4b
SHA512

e3fb8d412bb923e336aadaf7160d9395820a6d4f7d358483553e84f5ca88419da7996ca8442b249d755c8717c8afd3c5f33d7e8f086db64d95ffe4b157b97ae6
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4m9:fT+hsMQMOtEvwDpjoIHm9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014af6-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014af6-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2384	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2316	2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2384	2316	2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe	28
PID 2316 wrote to memory of 2384	2316	2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe	28
PID 2316 wrote to memory of 2384	2316	2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe	28
PID 2316 wrote to memory of 2384	2316	2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-01_17aa9bc80cd46e19daeba94d874463aa_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
504cffe4631c2f7f42aeea36caecb917

SHA1
2ce62c066edeaa2258326c3e6c77bb198561f12e

SHA256
d8d2baf8d985b26c2337275ed9d747d858fcae3fb01959f053fa7d478db59c32

SHA512
b36db74632548390f893c655edf0deb40345bedb70443561e23aa1b623d0c8ef761a3fea4cb9d0a4ff268f0cbe21238a5e64e3621ff03a8a4e0d645b4acae419

Download Submit
memory/2316-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2316-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2316-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2384-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2384-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download