9cd2bb9fce57cc0dd5f452f89042df07d2a7854708019038812d10cb3aa04dde

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe
Size

43KB
MD5

9601ceed7e1925e7ba9d6ee3706843c8
SHA1

73dda60018347e1176edbf98d0cfe7bae76ed76a
SHA256

9cd2bb9fce57cc0dd5f452f89042df07d2a7854708019038812d10cb3aa04dde
SHA512

eb99c8842ef32944d403e85e9ea2c0dbcd2c96871f748000aa0915e7d3e9a1d4510901f459c854d529714ae85890662609635771fa8347008fa5c948da8ce8d0
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66Tc5:vj+jsMQMOtEvwDpj5HW5sc5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001232c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001232c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1916	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2272	2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1916	2272	2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe	28
PID 2272 wrote to memory of 1916	2272	2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe	28
PID 2272 wrote to memory of 1916	2272	2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe	28
PID 2272 wrote to memory of 1916	2272	2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_9601ceed7e1925e7ba9d6ee3706843c8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
43KB

MD5
44272f3a80116fb2d71dd924c133e14d

SHA1
9453e662506ec03a2c7a70a83b0e0497363f223f

SHA256
d8dc225f665ec66b3a1b6b4f87a4e410f01c4f3fb2525127f716016123bb0452

SHA512
9d2d5bae3e4d6577ba47fcd4aecc88a6e75077b8ceb933bbef140ae2d833874af2d69870685dac57c976438ff863c7a47e0d6067d81c8b49777d6901148b763b

Download Submit
memory/1916-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1916-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2272-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2272-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2272-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download