1813aa1e49a4efe526e2a7645d1ec5add28b3751607ddc51ac4da27c825a80ac

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe
Size

44KB
MD5

621cc8adc593280098b0d0492d7507bb
SHA1

6aa79cc5a60d6506c50e0d19d5dfae0e51321a29
SHA256

1813aa1e49a4efe526e2a7645d1ec5add28b3751607ddc51ac4da27c825a80ac
SHA512

16b2867bdb2abfe9dd276691085824c58a3a159e1019bc67842317336c25026726af3985456ededf2195861cb737c92d0d5237320a89be4a7197ab856e899f80
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66Tcuu:vj+jsMQMOtEvwDpj5HW5scuu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2504 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe

pid process

3028 2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2504	misid.exe

pid	process
3028	2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe

description	pid	process	target process
PID 3028 wrote to memory of 2504	3028	2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe	misid.exe
PID 3028 wrote to memory of 2504	3028	2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe	misid.exe
PID 3028 wrote to memory of 2504	3028	2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe	misid.exe
PID 3028 wrote to memory of 2504	3028	2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_621cc8adc593280098b0d0492d7507bb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
44KB

MD5
46ff938eeba1286117ea1f7574390fc9

SHA1
99ff11abb9019a8842567c17538e0bfcc6d475c4

SHA256
6069cb7d6713344e6e45719dc4139fa1a902959503ba04d2a5835a9e979b27e8

SHA512
0f873a3c44b08af3b4076a005106b91ba32cc967bae3982624b60d0ccbd33261f9041ef4eca9663dcffceaa74dddcc5d491f2fa30595a5dfc08b9e3020a476ea

Download Submit
memory/2504-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2504-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3028-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3028-1-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/3028-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download