68fbe75899dfbf79d8e88d9cd86f8a7dc846850efc9577ab1741692a42d81bd6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe
Size

81KB
MD5

106cc226b21c8a38d7d2eae96a898982
SHA1

fb6f6e763e1c0d37c71a9592f33faa0e049eddad
SHA256

68fbe75899dfbf79d8e88d9cd86f8a7dc846850efc9577ab1741692a42d81bd6
SHA512

8f6b5f72820735f19b316b76c10f0a0293968d45ed0a7f4e64751a77a231f7cfee489aee5e4cf6cb6a7ddfed11aaebea25d0536aef4583b7dface73e96dd3d7a
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrMc:TCjsIOtEvwDpj5HE/OUHnSMF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/840-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b0000000122ee-11.dat	CryptoLocker_rule2
behavioral1/memory/840-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2632-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/840-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b0000000122ee-11.dat	CryptoLocker_set1
behavioral1/memory/840-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2632-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2632	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
840	2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2632	840	2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe	28
PID 840 wrote to memory of 2632	840	2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe	28
PID 840 wrote to memory of 2632	840	2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe	28
PID 840 wrote to memory of 2632	840	2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_106cc226b21c8a38d7d2eae96a898982_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
31a7edf5f54f6aab06986a27dacedf94

SHA1
63a6b5c7690302c18b887167e1259c23e34fd873

SHA256
acc65942193224d7f412a3e6f021e92a309f805cc0b9964649b441d257d5b1e7

SHA512
3229cb5f1e90495e7e6af4d4d02f15533050401eef032d0d2e4413431746474c9ebae696c5680de99770aee3ee15526e18198350e3823e78148dc3ec4d54282f

Download Submit
memory/840-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/840-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/840-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/840-3-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/840-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2632-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2632-24-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2632-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download