63b58e44e3db1f2920db0e773bf37431e45948f0e1305d7a7b2ff9be7ea02f78

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe
Size

63KB
MD5

86013b3b91219b8c2831258f57999301
SHA1

17432185db6d8befa8620a3feb22ebd453b388cf
SHA256

63b58e44e3db1f2920db0e773bf37431e45948f0e1305d7a7b2ff9be7ea02f78
SHA512

be04cf07f891982a6b1e283990e9975fe7b2985ec115c00b6f2c0c4ca5a58a19c2c621d58ef5403d7717988ffe8973fef7b80be73b1223d15df3469401e3c901
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9f:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1412-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000016c90-11.dat	CryptoLocker_rule2
behavioral1/memory/1412-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2816-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1412-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000016c90-11.dat	CryptoLocker_set1
behavioral1/memory/1412-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2816-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2816	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1412	2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2816	1412	2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe	28
PID 1412 wrote to memory of 2816	1412	2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe	28
PID 1412 wrote to memory of 2816	1412	2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe	28
PID 1412 wrote to memory of 2816	1412	2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-04_86013b3b91219b8c2831258f57999301_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
0e4c319ba2a2abafda6bd1abf69b9c3d

SHA1
2a7e796afffe9dceca0762d6ea234fc5bfc8427e

SHA256
a41975fc0669ce2d9b0017e66ae3c74615f5d3ec60d947f7fc3d7237b4a23c31

SHA512
3cce773ba330335a8bd3e80a87a8e3905f7313f221d98a0f5608965f0adcf38216e686c07075df0e3d3510a8b901eeef059931f47f634bc1e71a2b574f5769c2

Download Submit
memory/1412-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1412-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1412-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1412-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1412-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2816-17-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2816-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2816-25-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download