e69be6a577ff3b475c7714d898175af9dcc55bb041c5d854a8a8119ea3545ceb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe
Size

48KB
MD5

b876cd727c1dbee10d3c3cf81d23fe3a
SHA1

ef01cba2464be24cf7c1f7d12f1d6e5b0022e900
SHA256

e69be6a577ff3b475c7714d898175af9dcc55bb041c5d854a8a8119ea3545ceb
SHA512

a33b96f9e84d034c8ec71e24c4ab728b1e9e2ad94232786f86df9a54d61bbd9eb4505e3c10d5d9f3fb5982ef69565990a80fad37279a16372fca9e7ba1197ddc
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0n3:vj+jsMQMOtEvwDpj5HczerLO04Bs

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2120 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe

pid process

2500 2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2120	misid.exe

pid	process
2500	2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe

description	pid	process	target process
PID 2500 wrote to memory of 2120	2500	2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe	misid.exe
PID 2500 wrote to memory of 2120	2500	2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe	misid.exe
PID 2500 wrote to memory of 2120	2500	2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe	misid.exe
PID 2500 wrote to memory of 2120	2500	2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b876cd727c1dbee10d3c3cf81d23fe3a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
48KB

MD5
7fb8be8b1fe4989eee011718c1aef559

SHA1
e5b14bfae63dcd01dfd9efe77abd1fa9b51d8c87

SHA256
9d9caa60ed2e95a7692af6c77dcd01f0087e182151ee94831fded18cabbac482

SHA512
1db83bd066f174ca30d373be533559757bd2b603d3a18b58f54580c891295b18df0cd120644adf9e07469078ce54b2a863ab576bb0858b4448ca40baecf1da05

Download Submit
memory/2120-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2120-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2500-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2500-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2500-7-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download