db1cdcb61ba1a59096d7f8992db2693281f7f0f9c0ed9ba65e509d6a517b346e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe
Size

37KB
MD5

25b3f0f2c796cd36c9da555434438be7
SHA1

c31d8c6b8919963687b8fd7588bdfd5909e0d9c3
SHA256

db1cdcb61ba1a59096d7f8992db2693281f7f0f9c0ed9ba65e509d6a517b346e
SHA512

cb79c5323f92701112a97b0a95f5df0ad8de63845a722dc42e81e526266da9eb3f44e74154437fc9f42f03815f94119ca2343ddf40de3500acc7dba8518d179b
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4qo:fT+hsMQMOtEvwDpjoIHX

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2188 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe

pid process

3068 2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2188	misid.exe

pid	process
3068	2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe

description	pid	process	target process
PID 3068 wrote to memory of 2188	3068	2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe	misid.exe
PID 3068 wrote to memory of 2188	3068	2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe	misid.exe
PID 3068 wrote to memory of 2188	3068	2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe	misid.exe
PID 3068 wrote to memory of 2188	3068	2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_25b3f0f2c796cd36c9da555434438be7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
cf3cd7f8da10147f693f6b6a8fce1b0a

SHA1
3d45534c8ab9f1e49f9234082c64c17e3c2441a8

SHA256
78d7f96b5f63e650e328dcac1723f280eb97c365c64fdc6501b58a627cac456e

SHA512
0f8d109a14d1a383e9305ea87d43734036f8cdb6586de4c6b450575f3c0b9067b76847880765996312f7baa5e1c66fde15635ce5a8deb67c405e200e872a81c1

Download Submit
memory/2188-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2188-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3068-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3068-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3068-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download