18a3b0ed094abc0bd6d5c7f0649e81f8a67594dd76ea9bd25f6e5087da9b9983

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe
Size

62KB
MD5

3dc5d8f08e9d1f4fb64b94e5a01b24b2
SHA1

586388baa3f43c0d6d2b33b161056a478f0873c6
SHA256

18a3b0ed094abc0bd6d5c7f0649e81f8a67594dd76ea9bd25f6e5087da9b9983
SHA512

a71a9dfeaa3ff4dbbf7660982339564f9e12bba8e63174d348f8356a5d7b9a2681f36e69175aa335a607d48c7d9fd295fb11f958451aa0bc04b18947a200bc0a
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9P:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2952-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1964-14-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2952-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2952-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1964-14-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2952-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2952 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe

pid process

1964 2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2952	misid.exe

pid	process
1964	2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe

description	pid	process	target process
PID 1964 wrote to memory of 2952	1964	2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2952	1964	2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2952	1964	2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2952	1964	2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_3dc5d8f08e9d1f4fb64b94e5a01b24b2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
0393be49e502e4805e2891a58ddf9ccf

SHA1
b49c57f07eac412e0e07b04d51acb369101863a6

SHA256
fa90632d7eb538a253c959dbcbcd939800e67595416790e473161fd7f069321c

SHA512
341033a15f2e738565cec3ea5c5894fcf793c7b8e1ea1c082a0dd253fd064fb39ea5a4fcc7c57daa479054626e00b5d368aee334b65bfa2674ba92c948352e89

Download Submit
memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1964-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1964-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1964-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1964-14-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2952-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2952-25-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2952-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download