d8b29e5208ceb02250633fd4e45a49e282c272aa9f304ade0f70772659cfd075

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe
Size

48KB
MD5

afccff4e31a4b7ff173955479ab5eb73
SHA1

7a8f9f097d519fedfe61e27e0d12bef1c440f047
SHA256

d8b29e5208ceb02250633fd4e45a49e282c272aa9f304ade0f70772659cfd075
SHA512

7a0a13922170c5233464e5e8ccdb61b574db424fb9d6d18a57d6ddc82280c4b4ec5f70b7fab9e310531b4f359bd4ef998e5f2b817f9194df35708f89fa3a7cde
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0nkY:vj+jsMQMOtEvwDpj5HczerLO04BQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2760 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe

pid process

2028 2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2760	misid.exe

pid	process
2028	2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe

description	pid	process	target process
PID 2028 wrote to memory of 2760	2028	2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe	misid.exe
PID 2028 wrote to memory of 2760	2028	2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe	misid.exe
PID 2028 wrote to memory of 2760	2028	2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe	misid.exe
PID 2028 wrote to memory of 2760	2028	2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_afccff4e31a4b7ff173955479ab5eb73_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
49KB

MD5
b559cd368488d36cd36631eedb1c8217

SHA1
37913102897e823fd5aa2ef73496502fc95f6dd3

SHA256
79273c04e800b118c6759c6d54df828306612a7c89df3c7bc387000720b8dbbe

SHA512
ac7499c6b62d896ed971566653a709c72d86e6f24ff28278666cf9615ee7b6c6a9c7307e64643d496040bed2f00f45393820e2faeb64da991c560fc0a4771276

Download Submit
memory/2028-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2028-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2028-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2760-15-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2760-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download