43387156f45f26aa521906bb50b6e3e7b33609cfa2a66c679f4412003890802d

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe
Size

71KB
MD5

b21adf64e5ab8ba778e443d019029f2d
SHA1

76fe392e64bd21a74a68e61f7c8fccfa92dfe7e0
SHA256

43387156f45f26aa521906bb50b6e3e7b33609cfa2a66c679f4412003890802d
SHA512

b0aac561cf6fd1c3b2efc4d6d8bf74adc71ecc4a7ba7e000ca1330de06716b7aa5cee78d08e63129c92293dafadc9c54655ca959e81f1a94ae39a6f9e86280dd
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Rm:vj+jsMQMOtEvwDpj5HZYTjipvF24u

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2052 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe

pid process

2248 2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2052	misid.exe

pid	process
2248	2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe

description	pid	process	target process
PID 2248 wrote to memory of 2052	2248	2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2052	2248	2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2052	2248	2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2052	2248	2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b21adf64e5ab8ba778e443d019029f2d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
72KB

MD5
eaad78eef9bd8c87611247883e5984cb

SHA1
6c7d73843fed911ef2b662152fcb184a4b5da65c

SHA256
a26bdc66cd8c9504b5ca01c25e77ea08538cf067068dce9600b0462222f20015

SHA512
525e09982e8041f72181ac48b76d18e08fee678091ca2aac095dc4a6433247d211e6d3b7ed8c9d06bc6cd63ecfa2983b933f8d51c59b73485aafe177501ca002

Download Submit
memory/2052-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2052-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2248-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2248-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2248-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download