248e94628fee1031c043bcad83ce59f33ae4c350fcf38de4120131e9dcff75e6

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe
Size

37KB
MD5

99ac7819000a73a445ce1c8bb60ab6f6
SHA1

eed4f347fa921a68647d2344dd7f835b3b68fa57
SHA256

248e94628fee1031c043bcad83ce59f33ae4c350fcf38de4120131e9dcff75e6
SHA512

c17139c6e99e54ef934e52bec2867030e6ad2d2f99a3bc6c2c0b851caa8dd7fa41c7ce1b9e63e60eaefed8b5cee49b914eecbbaa8ff91e9e9fc323c1157b8e76
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4qr:fT+hsMQMOtEvwDpjoIHM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000120fa-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000120fa-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2364	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2364	1700	2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe	28
PID 1700 wrote to memory of 2364	1700	2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe	28
PID 1700 wrote to memory of 2364	1700	2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe	28
PID 1700 wrote to memory of 2364	1700	2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-19_99ac7819000a73a445ce1c8bb60ab6f6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
e9bb4b46fdc7a7da0e31fc8cf2f2c9fa

SHA1
7ea348e7814e27a984cdb7b8edaa1474c4e1c0ae

SHA256
720c42e60129bd787e0bde4fa6f6ed827d0ea5f9862edf9d21dd1b75943a301a

SHA512
1dbb784cfb771ed8b6db40c8fff4098935244e4cbed6ccf6643d5994d419415b78200e8548c0ead77365cbac741bc2989f0ac49c1e92464ecd11842dba984ee4

Download Submit
memory/1700-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1700-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1700-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2364-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2364-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download