51c5fd50dad412619bc3e7fccc10bd64ec57398cbe1622425532a2401238ee6a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe
Size

37KB
MD5

53459cb417384be20ab946cf311c352a
SHA1

853dc7ed4652f355bc26f7f94370e6e3f0e66df1
SHA256

51c5fd50dad412619bc3e7fccc10bd64ec57398cbe1622425532a2401238ee6a
SHA512

03d11bcfe37a90494440dd8d43e238da3ceef3d7b40eb42233404dce7477fefe7787111e7144c7b703b68a77dd67396f9c7063fe327b7160ae480e20aab7a854
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4q7:fT+hsMQMOtEvwDpjoIHE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2904 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe

pid process

3036 2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2904	misid.exe

pid	process
3036	2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe

description	pid	process	target process
PID 3036 wrote to memory of 2904	3036	2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_53459cb417384be20ab946cf311c352a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
37KB

MD5
8c4948ec849d7e238721e0d054201d92

SHA1
d5949e3b6c6f898351525a6ea9fa096c126956b9

SHA256
e6b75067fd33f44b729dd2e82cfff2352170274adf76ed145666a2365c6bee37

SHA512
8e5f4b1567e4615b8cf639036fa1e41b9176e6b6f64844e9dde9c6d1ed3c9f2f0923252dde844f635da306e4901aef407383489aa08f512a3ca1433127909fae

Download Submit
memory/2904-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2904-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3036-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3036-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3036-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download