2e43a54895712aec60db71d5f6feb7cc70991db563086230884932750a58d60b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe
Size

78KB
MD5

53fd5ee86c6076dfb56943247ad0e8a6
SHA1

78c921965c35a43f17c734d1200b912523eff1ce
SHA256

2e43a54895712aec60db71d5f6feb7cc70991db563086230884932750a58d60b
SHA512

560172c1ac2f906ab12a89123e2bcf8c00249aa7af51cbb825f8a82a58ded357be60b443f6e48e4002ac6d033b30d38f3a88204b036c91792422eb7ea103ed0b
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIufR:vCjsIOtEvwDpj5H9YvQd21

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2968 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe

pid process

1992 2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2968	misid.exe

pid	process
1992	2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe

description	pid	process	target process
PID 1992 wrote to memory of 2968	1992	2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe	misid.exe
PID 1992 wrote to memory of 2968	1992	2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe	misid.exe
PID 1992 wrote to memory of 2968	1992	2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe	misid.exe
PID 1992 wrote to memory of 2968	1992	2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_53fd5ee86c6076dfb56943247ad0e8a6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
7166e6d0f1c0589e6973cfe941fbe641

SHA1
0160f9c38b2e43ed1f697386934b6a62c31c205d

SHA256
eccc5c45c60ff0c17fb938b8121044bc4218b55cc54006800d7d6c8c4e0bab83

SHA512
6acdc0c558d9f0c8604c4551a0a2cd686537fead1adbfab709d9614dc643cbe447550dc6a5d34b123eadd29ea56ca2a10690aaa61394a3bd4494beefbb2af84c

Download Submit
memory/1992-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1992-1-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1992-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2968-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2968-22-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download