174ed15af0642a71ee4aea99ad206b1572db32a6de4e0ca4766fb76c1bbcbe87

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe
Size

82KB
MD5

d884cb76e542b725379848b557bc2e7c
SHA1

951d803295f88cf42eb20491738a6ed300fc184f
SHA256

174ed15af0642a71ee4aea99ad206b1572db32a6de4e0ca4766fb76c1bbcbe87
SHA512

8349f13a6cedb387b6229bc54ff1c36d13a2de54deb6d4ba43d84061552cc47ca6be2354b4ec75e57eebdb4d049e0dfa7ca23cec4bf662cd9413c2e7d19c6c93
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMr3U:TCjsIOtEvwDpj5HE/OUHnSMa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1280-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c0000000144e0-11.dat	CryptoLocker_rule2
behavioral1/memory/2800-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1280-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2800-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1280-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c0000000144e0-11.dat	CryptoLocker_set1
behavioral1/memory/2800-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1280-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2800-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2800	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1280	2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2800	1280	2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe	28
PID 1280 wrote to memory of 2800	1280	2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe	28
PID 1280 wrote to memory of 2800	1280	2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe	28
PID 1280 wrote to memory of 2800	1280	2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_d884cb76e542b725379848b557bc2e7c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
33559c740510faded16d57155075399b

SHA1
63bce26097cfc81ae599d89787e67c426c85f46f

SHA256
6baa38b1372ec1c9f317c644ff7bb6370ffcea0b3fbfc36b289ae9f401f7b3bc

SHA512
f67813674409e33eef15265e2d68d9026e99b33ea399b283d2dee0414471c592d6bb25f85fab05e93536d327984ff5468ae11251609ac77e2546fcac2bf18982

Download Submit
memory/1280-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1280-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1280-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1280-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1280-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2800-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2800-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2800-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2800-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download