5a4cf9c0e4be0a31897c48a157df64af4a6312d7df748ebc38e529f95e18bc14

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe
Size

57KB
MD5

8c15eaa5913988b4b83070bdc1f34b71
SHA1

4bf270e61a533e353dfd81006f502bd0ab54bcb3
SHA256

5a4cf9c0e4be0a31897c48a157df64af4a6312d7df748ebc38e529f95e18bc14
SHA512

65badc673b8ca1c3ac974f18a4e1c52b9964030ca092ebff5792ffd1964a8cfd5b1bbcb7ef9c56355239b8e0793fd88d91ad5ed65cd30f5ab6fd2b85fc250dff
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFv6dl4G9:vj+jsMQMOtEvwDpj5HH1nw73KOFiD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001342e-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001342e-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3044	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3044	2240	2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe	28
PID 2240 wrote to memory of 3044	2240	2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe	28
PID 2240 wrote to memory of 3044	2240	2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe	28
PID 2240 wrote to memory of 3044	2240	2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_8c15eaa5913988b4b83070bdc1f34b71_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
57KB

MD5
654f7b359fbbe66c5b221ee3baaf03e1

SHA1
3642f8086493da7cfb0ac41cca8b5f85c1d3ea1a

SHA256
ad4b8118bc1a378c48e8d5b2ab3c4d80ccec2ff92ffba80a0d0bd8230b9c9d7d

SHA512
26b90fd2cade892d410bcb9708e9ea4127e77ec524d46fc9194b5f4334b62833a1301c0fe8544d594877e9c2cc607cace4152c92432a121ad41b0fb3872ddd44

Download Submit
memory/2240-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2240-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2240-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3044-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3044-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download