fe151a4f1418a0b79eaa175502148543c636e318fb16f6ec17cded2547db3bea

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe
Size

48KB
MD5

96b46d78909e27c340fa78bafe622949
SHA1

9ee12c13b1d11850ec5a35af98a22d5e337e2de4
SHA256

fe151a4f1418a0b79eaa175502148543c636e318fb16f6ec17cded2547db3bea
SHA512

4ae74333432fc17da81c7d9c6590d6436989d8e54a91bc089312eadb794611977cf784bd38ed8d9c713e7e039b17ef0dd76dc80be925efa8e87d1d6f96bc0fca
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0nkM:vj+jsMQMOtEvwDpj5HczerLO04BE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2740 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe

pid process

2124 2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2740	misid.exe

pid	process
2124	2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe

description	pid	process	target process
PID 2124 wrote to memory of 2740	2124	2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe	misid.exe
PID 2124 wrote to memory of 2740	2124	2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe	misid.exe
PID 2124 wrote to memory of 2740	2124	2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe	misid.exe
PID 2124 wrote to memory of 2740	2124	2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_96b46d78909e27c340fa78bafe622949_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
2aec9e4f26e158cdf5e3774529d6450c

SHA1
846cfb22e582e73b1d0270a3e9acbd7a9d1248fa

SHA256
fd2ab39f8ddf1233ee9bddeb181dbc18fd5f76e0f17ca0788f5db2cb99bc647e

SHA512
da27eb78a171f4d9b7cbe69a44ef15d887aa44c016e72c7f71bfda4033c5312e3bd19f23cbf74bec3fe305734bee06e97beddcea37011436b4314ff70487c1f2

Download Submit
memory/2124-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2124-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2124-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2740-16-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2740-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download