d4b1425079dc1a8817f8c2316dd6b2ff02988f11b92e446b8dff061a227979f1

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe
Size

66KB
MD5

b118cd789c79b9a42499bc8119ef5ec7
SHA1

36d6f61fa08db3b4abd23def2b46ae7bec3faef3
SHA256

d4b1425079dc1a8817f8c2316dd6b2ff02988f11b92e446b8dff061a227979f1
SHA512

2f68384da052fd3f2d7e4ff32e27e82d54c75e2adbc803958e3d430a957a693e443db5ede255f013aafbcfad728ba4d7834ae37be294c56fe9bb053e311472bd
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdfGyeP5:TCjsIOtEvwDpj5HE/OUHnSMYv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1684-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000013309-11.dat	CryptoLocker_rule2
behavioral1/memory/1684-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1208-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1684-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d000000013309-11.dat	CryptoLocker_set1
behavioral1/memory/1684-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1208-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1208	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1208	1684	2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe	28
PID 1684 wrote to memory of 1208	1684	2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe	28
PID 1684 wrote to memory of 1208	1684	2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe	28
PID 1684 wrote to memory of 1208	1684	2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_b118cd789c79b9a42499bc8119ef5ec7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
66KB

MD5
40e9e42aa82c519b63066aaf7c516d0b

SHA1
c89132b400ca4a0928d731bab0a194daf58ac1bc

SHA256
ef4405937d5d403f7fc00099398c2e11ede749c455e396dd442ec98ac610ed88

SHA512
6afc35acb93824bc7a96e0c15f5ce0d9725550c489089e30e4f2c90479515cc3324a8e72724f89381d00fabe434e5cb2fcfdfafc8934eb062b1f5fd344a7a68c

Download Submit
memory/1208-18-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/1208-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1208-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1684-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1684-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1684-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1684-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1684-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1684-15-0x0000000002880000-0x000000000288E000-memory.dmp

Filesize
56KB

Download