a70dce8b9c522de41b9f59d11657b7fb8a6ea09930ea1535652e60c8a8f09dbf

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe
Size

121KB
MD5

1ecba9686d82cc5205e97e4825ed5a06
SHA1

03dd8c87663603de8a9706cec9b34f99c19adc6e
SHA256

a70dce8b9c522de41b9f59d11657b7fb8a6ea09930ea1535652e60c8a8f09dbf
SHA512

59928fc031d8dbdb8cf0ffb31fbece23a4cb7eb9f49cbb526ed2a8f2f3cdbe5d0df6c21085cbbcb1f162a6a7f570247e60e335fd49322efb3a1015ffe9880b29
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTK5y:gUj+AIMOtEvwDpjNbwQEIPlemUhYaI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012336-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012336-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2176	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2176	2192	2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe	28
PID 2192 wrote to memory of 2176	2192	2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe	28
PID 2192 wrote to memory of 2176	2192	2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe	28
PID 2192 wrote to memory of 2176	2192	2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-17_1ecba9686d82cc5205e97e4825ed5a06_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
122KB

MD5
19bf0b821cb8ea04e5c0b4ccf6eff3dc

SHA1
539b724e881c6345511edeef467fca7c46d8f4f4

SHA256
bed9a6897ccce58ac205c449fb1132c3312240f88531bc2273ec662d2a24ee65

SHA512
166ed1e194fb73a0ec5c50bf9e76b63926626f64413f1c2aa3e79c7d2a02ff644fec692c51615db0ebac3b7ea4db407cf55930033df615d5e6b47f50f02acf4b

Download Submit
memory/2176-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2176-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2192-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2192-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2192-8-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download