4e1b3f08826161420017bf6ddfda34b9e13b58e77cf0c3b674d5536e40f36e7f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe
Size

86KB
MD5

c86d4c923f90c3b6432ef8f31cd32517
SHA1

af872eaf647af6b8fb9efc52ed5399391196c315
SHA256

4e1b3f08826161420017bf6ddfda34b9e13b58e77cf0c3b674d5536e40f36e7f
SHA512

7b902b2d5bb4e9e27be04833e7901e75e60f7dbcf19c4fce63d6e22f05aa6b65736945524b5d76f30e222195c93e1a5003e6426a56fbb12506fcc070c329860c
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNBULa:vCjsIOtEvwDpj5H9YvQd2p

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012286-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012286-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2780	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2780	1964	2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe	28
PID 1964 wrote to memory of 2780	1964	2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe	28
PID 1964 wrote to memory of 2780	1964	2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe	28
PID 1964 wrote to memory of 2780	1964	2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_c86d4c923f90c3b6432ef8f31cd32517_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
7ee8a936e635d140deaf1e52f9c32b95

SHA1
013929ce591b322ff68784b7657b154ea46fea95

SHA256
7ba81f51ae7f75276274f8e31bb794953f5a87a9592c31d59774466b8a604d52

SHA512
cf46595672205082914a58b1cba5b522634a08a44d4df0403c921dd45f5fb585d4a4a270565cade6ecbcc0d5c08c4458a7970fea8b1e151950be592bd47a3cd7

Download Submit
memory/1964-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1964-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1964-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2780-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2780-22-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download