279ecf6e6c13fc17bf0b35020df942841c6e522a785daf29f00b177d393089ee

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe
Size

70KB
MD5

0224ff12e526a1d75b04141e875c9474
SHA1

7d032b1908a6c7a4da3b0572c7bfc9de41448351
SHA256

279ecf6e6c13fc17bf0b35020df942841c6e522a785daf29f00b177d393089ee
SHA512

6ab436a9ae27a604e36f01eb500dcebc7fba3648600c2b35eec6a35535e27521e94d1fc7596fd44d45af5d6c90f1f861c18fe0608ff0255edaa03526c2d42cd1
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/RL:vj+jsMQMOtEvwDpj5HZYTjipvF24j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c5d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c5d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2588	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2588	2256	2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe	28
PID 2256 wrote to memory of 2588	2256	2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe	28
PID 2256 wrote to memory of 2588	2256	2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe	28
PID 2256 wrote to memory of 2588	2256	2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_0224ff12e526a1d75b04141e875c9474_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
690bd6214f0b2e0d08d56a5d71f0c4ce

SHA1
2634a64e31724e87348d4986debbcb1a7ba5c7ee

SHA256
b518be7e2255d1ac238d8ebc94afe3ef6f57e9c3f5f73972c667b5da4b903c58

SHA512
01820966997e25050fee971b51eb0678351fdc4b640da67f13066f71b765308fcf0941fba8d9fc705a4997754bef91cc33c02fb4b6a5c8fb804ecd4fb101889f

Download Submit
memory/2256-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2256-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2256-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2588-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2588-22-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download