2a3ac6abe16384016a520b4f35eee1e4673be7ff8f389570e0aef76920f71428

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe
Size

39KB
MD5

242a6dbd5c5ea4f815854b4f700fd884
SHA1

bb935abc35a9e03a61231aa292e4c4ec1a91f40a
SHA256

2a3ac6abe16384016a520b4f35eee1e4673be7ff8f389570e0aef76920f71428
SHA512

cf35ee4d86f49a0a917e40ef47d34a029cbea11585d0ec538cb0db001e6b161d6cff0a052dbd885684b8ea16a5e2d7ff2a2af3bf29c6cbf17dcaafccdfc536aa
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/UkRYzMAZ+geslx:vj+jsMQMOtEvwDpj5HcSYPCEx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2484 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe

pid process

1368 2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2484	misid.exe

pid	process
1368	2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe

description	pid	process	target process
PID 1368 wrote to memory of 2484	1368	2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe	misid.exe
PID 1368 wrote to memory of 2484	1368	2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe	misid.exe
PID 1368 wrote to memory of 2484	1368	2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe	misid.exe
PID 1368 wrote to memory of 2484	1368	2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_242a6dbd5c5ea4f815854b4f700fd884_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
39KB

MD5
257984fac334d6924887e91181111538

SHA1
456f378d56bc6f4c801c80fd2b1f9b20f15f7552

SHA256
e1b783cab241467e6c92d83b8fb60a34c34c7bda26dc5c4b01354bd70f899a2b

SHA512
5b5c9bedb2ac15ecc09020b964804889fd918b11d88ce252e784b5db65a5aa7eab5d93050e5524d5eb297de30f8bbbd7bbd6e4eda8872646e571c0344f32509e

Download Submit
memory/1368-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1368-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1368-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download