5bd569140304be156d21c71673176568af508399091279d7392731bde0beea49

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe
Size

85KB
MD5

5363d13f6051ad3018fb1bba2e771a96
SHA1

7bd0283e201a5fa8bfd5c6fbecc60c2d1f21ce3b
SHA256

5bd569140304be156d21c71673176568af508399091279d7392731bde0beea49
SHA512

cb15d56d20f3c5e71d598a88519f04fabff6fa2479ac6fc94f061e226b9c69bf60286d7f4eb7157adceab50a8e95dc788fa49e0a5d2d2f975417ab453a90253f
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrC+a:TCjsIOtEvwDpj5HE/OUHnSMY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2956-14-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1784-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2956-14-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1784-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

1784 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe

pid process

2956 2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1784	misid.exe

pid	process
2956	2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe

description	pid	process	target process
PID 2956 wrote to memory of 1784	2956	2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe	misid.exe
PID 2956 wrote to memory of 1784	2956	2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe	misid.exe
PID 2956 wrote to memory of 1784	2956	2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe	misid.exe
PID 2956 wrote to memory of 1784	2956	2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_5363d13f6051ad3018fb1bba2e771a96_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
85KB

MD5
9ba9674c5307d9d0d612e64d8b971be1

SHA1
14edc1d7e49a49b8b93a5791afee1970c623c67d

SHA256
a729c76cd30a6b24e0c8d9169832170e2d77fa46dbbf52a6f72d3d73c299dbad

SHA512
c4a18e5061f7e082e076ef367ca3b1680ffa2a1cad606dc650fbad3614fadbb0a2c73170e5c106f45a4596375e1ac65de05a8e29951a71148b2ff4a34b3545ff

Download Submit
memory/1784-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1784-24-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1784-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2956-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2956-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2956-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2956-9-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2956-14-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download