00e7a7af1cf28ff55486da2569b4c97d86ec7438cb11dd71288aac415545fdaa

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe
Size

61KB
MD5

856825e0e9a0566e93cbae77ed08ac3b
SHA1

1d35d560c53d2eed902f77cc34c748a90011841d
SHA256

00e7a7af1cf28ff55486da2569b4c97d86ec7438cb11dd71288aac415545fdaa
SHA512

c50baabc40aa463552c67bb91722359fbf14c98d30f2c9b2383867c9aa7a49ca802b6a624c727a5557eeeb5bd2e5fa797f6922dc3d28c9029b9628b84a49bda5
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG92:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/files/0x000c000000016056-24.dat	CryptoLocker_rule2
behavioral1/memory/2820-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2912-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2912-1-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2820-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/files/0x000c000000016056-24.dat	CryptoLocker_set1
behavioral1/memory/2820-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2912-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2912-1-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2820-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2820	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2820	2912	2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe	28
PID 2912 wrote to memory of 2820	2912	2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe	28
PID 2912 wrote to memory of 2820	2912	2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe	28
PID 2912 wrote to memory of 2820	2912	2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_856825e0e9a0566e93cbae77ed08ac3b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
b6bc898b3e7e14691464fe30e2c5425c

SHA1
3c74e73fba539ab50d765f69d8e84e17f2e0ce2a

SHA256
ffbf86bfb2287cecceb3f55625d2742e8be8095bd08eaa28285a7e9a83b07137

SHA512
624fdf2c52fdca86a314c1e72b8f91cfb4e6807498a77ae165642719babbe4a75b923830599abab131d0fee9a1fe4a79d363c5fc2d4818d54461d53da2b1d5b0

Download Submit
memory/2820-25-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2820-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2820-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2820-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2912-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2912-9-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2912-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2912-1-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2912-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download