2cd09af5a2d73efc3b465e021f04b5a3e3272f01963727f8fc2e27e5f28fc585

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe
Size

48KB
MD5

d2a5065525003fd2d808d724f53ffb18
SHA1

beb1e618618885180c86fb813b403e8b447a6462
SHA256

2cd09af5a2d73efc3b465e021f04b5a3e3272f01963727f8fc2e27e5f28fc585
SHA512

655b29b708381d889aa96b113b979fb8658c0b329e0f89e358009f036145f7f7ca3c22d1ad8b2e8e171e68e914517c979443155e21708e63fa643e37ecf54b65
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0nm:vj+jsMQMOtEvwDpj5HczerLO04B5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014909-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014909-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2568	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3048	2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2568	3048	2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe	28
PID 3048 wrote to memory of 2568	3048	2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe	28
PID 3048 wrote to memory of 2568	3048	2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe	28
PID 3048 wrote to memory of 2568	3048	2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_d2a5065525003fd2d808d724f53ffb18_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
dd0bad6e76901ae6ae04288730fab2f6

SHA1
fd7e336d31c9e4506032b829dccbeec425158003

SHA256
09530d67a22edfab79e80a8bbc142f84a0c42a85b96a7c7dcea83ec8271784d0

SHA512
3f9c95b9835747851f2c18ed9a679afb98bc67fe09a521ea94ac5717ec7165a5add5bbfd5963ceadb7ac0cbcf716b12d00302b6209879447632db5c0af92dc95

Download Submit
memory/2568-15-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2568-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3048-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3048-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/3048-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download