6da0b8759d7ea82ef06235d17e744b7400b67feaf0c85ea792ad28104a60e65d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe
Size

62KB
MD5

66173bfe099a87f101f42ec57d521ea1
SHA1

b60ee84ec3ad5cc608884b62f7e2b4f8ea32c4d6
SHA256

6da0b8759d7ea82ef06235d17e744b7400b67feaf0c85ea792ad28104a60e65d
SHA512

185cbbfbfd21830228c0922f2eb0cc1f5bb7fda4909c540bb8c9c2b39fcc463ca5bc16e55bc6e8618ccbbcee6e4c806b8d623df31a9b6a9824f5911f4a0a4743
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMNuS8L:TCjsIOtEvwDpj5HE/OUHnSMZt

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2320-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a00000001211e-11.dat	CryptoLocker_rule2
behavioral1/memory/2320-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2832-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2320-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a00000001211e-11.dat	CryptoLocker_set1
behavioral1/memory/2320-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2832-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2832	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2832	2320	2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe	28
PID 2320 wrote to memory of 2832	2320	2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe	28
PID 2320 wrote to memory of 2832	2320	2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe	28
PID 2320 wrote to memory of 2832	2320	2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_66173bfe099a87f101f42ec57d521ea1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
d8ab2996bad00d90c757eed7c2f41a5e

SHA1
e0e1a7f15dcdf8b9250c076132bbed1307879c0c

SHA256
d61d5e316849dd374299a5d7e0917fa6e892f2937f7d66e1400e88edffe0d671

SHA512
45ee5f066e8e15e564fb7fdf18863f3b1925d8fa5f290d838a7c457e47ea12ec30883f39ee01e9ea348a55d1137348957d15f0eee54a400da1a6ac3eaa0185fb

Download Submit
memory/2320-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2320-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2320-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2320-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2320-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2832-24-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2832-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2832-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download