18c9b07ef9196d22bbd03365e29d7963de57aaa668d94a93d67049706bf7bc18

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe
Size

37KB
MD5

94665fb01c96a1e40b5c7e989bcd2fd8
SHA1

1de70ddf8e8a7a45720115803d418450f4fe1ee5
SHA256

18c9b07ef9196d22bbd03365e29d7963de57aaa668d94a93d67049706bf7bc18
SHA512

6027dd6a645bb1e57cebb75ff687d8c7d613b88580b72f02a0c20843b78df6ab8c6c0f50e2a5876d33528051d74d61abc9aa863474810ecee66d719b3c771999
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4u:fT+hsMQMOtEvwDpjoIHu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001226c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001226c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2112	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2112	2036	2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe	28
PID 2036 wrote to memory of 2112	2036	2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe	28
PID 2036 wrote to memory of 2112	2036	2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe	28
PID 2036 wrote to memory of 2112	2036	2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_94665fb01c96a1e40b5c7e989bcd2fd8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
d2cecd2a047d8968d5ae96ebd471796e

SHA1
7eba7379a261dc5704b99a4edebbded180426d17

SHA256
cca886fe2521ee9b5ae0ad36f0439a100e52a034789dda38d5f8ac916ae81e0c

SHA512
a941e1a1d10dc4369b72aa898d7e0762c3322c789491649251d4cdd8baecd8a41d5bb14e2b28b6bb73133e60a2460b3276478937792e84ca3e4dcdaccd7c5a95

Download Submit
memory/2036-0-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2036-1-0x00000000020B0000-0x00000000020B6000-memory.dmp

Filesize
24KB

Download
memory/2036-8-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2112-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2112-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download