4d65913d112f4046bef916a0b722da189382039a1319bd4f0a4a5b35414f6b42

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe
Size

73KB
MD5

4aa3b1479f52016222a125b1ae7afb25
SHA1

2b79ba2bc7a84b5003ab3c50b492f63e05be94ca
SHA256

4d65913d112f4046bef916a0b722da189382039a1319bd4f0a4a5b35414f6b42
SHA512

46394a2ca8305a90807f11cd41cbb4dcdc5c4598775016e1a7cc53205ce9695b8993b9d670913e2b26eba038ea6bdadae53fa7df498a8787e2e029ff6e3cf7df
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/R/:vj+jsMQMOtEvwDpj5HZYTjipvF24ff

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014267-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014267-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1904	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1904	2020	2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe	28
PID 2020 wrote to memory of 1904	2020	2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe	28
PID 2020 wrote to memory of 1904	2020	2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe	28
PID 2020 wrote to memory of 1904	2020	2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_4aa3b1479f52016222a125b1ae7afb25_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
256abd6c4d51cc604c433cdaeee4b5bc

SHA1
281cb4e0b2bf2a673d4c8f4d57b0dacb292c509d

SHA256
6c4c28282462cdaf6d0e09d2bb879f08a70a618d1279ce97934b94ba25d52836

SHA512
f5add0bbb76137a6147de97b9385759c114ae9eabe45633f6404351fc9824003e292b697839499fc262d0c9340bc4485464c214b5650ab54e03f518e775e1c87

Download Submit
memory/1904-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1904-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2020-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2020-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2020-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download