0550c89a273589881272e67b4fc8379c73f55664cd3791af67a7f00fa5d06cfe

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe
Size

72KB
MD5

ba9900ff24c50fb385f20996487420e6
SHA1

28c5a99e4bb4b9ad86e72a6dd8fd46267ed77731
SHA256

0550c89a273589881272e67b4fc8379c73f55664cd3791af67a7f00fa5d06cfe
SHA512

b028422ba6036fb2582cf5140a8912b78e01fd2294c4257d2146cad40112c36e5afc0ea7f8a2d50476b51c151ce05c1dcdb69e45d6297cd41edd2cd62067f2c1
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Ra:vj+jsMQMOtEvwDpj5HZYTjipvF24y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014284-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014284-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2776	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2776	2884	2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe	28
PID 2884 wrote to memory of 2776	2884	2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe	28
PID 2884 wrote to memory of 2776	2884	2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe	28
PID 2884 wrote to memory of 2776	2884	2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_ba9900ff24c50fb385f20996487420e6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
72KB

MD5
fbf8626163a3f25761fb613020a50d83

SHA1
87dad2faee677d00e425130cfc1887f060c7ea38

SHA256
88e599ec72e460789e3df487f69bfad2a302ca747cef9978cd73faae0857a934

SHA512
dc506a91dcca6796e273553bea54b69ec69c149ac1942163e7e1d90b811ba5684ca482a046f86f008ecb33a06e18377e17f4c3c0eed341cb6a679c74bd23e0bb

Download Submit
memory/2776-22-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2776-15-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2884-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2884-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2884-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download