f99ec16665002ae6261b48f919568b9fca0e0eecb73e5fe7dd02e0e4ce236eb1

Analysis

max time kernel
95s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe
Size

37KB
MD5

e7be04feb2f6da249997327e6edba3e4
SHA1

541344627dfa53865f2e9428e2de853d2b82f14b
SHA256

f99ec16665002ae6261b48f919568b9fca0e0eecb73e5fe7dd02e0e4ce236eb1
SHA512

69e285a3cb9166553dc3b27b89ffec059deb46f38aadf7ce603a7e0a7f826347a1a79283f6b409c85f64cc1341952c97cdf95a9f48268a72235def467600f458
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4M:fT+hsMQMOtEvwDpjoIHM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e00000001214d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000e00000001214d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2068	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2068	2740	2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe	28
PID 2740 wrote to memory of 2068	2740	2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe	28
PID 2740 wrote to memory of 2068	2740	2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe	28
PID 2740 wrote to memory of 2068	2740	2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_e7be04feb2f6da249997327e6edba3e4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
d04ffd3609b83be84ec3a37cb366a749

SHA1
8b2b7d46b4c544ecaad29189a75e3e85408dbdd8

SHA256
d79c608a6abe6991522a800dc8472dcb51c984021c0cb4c1a0ee87eeaab8380b

SHA512
ec5e6912293cd4bfe9a8d34b05fd9a7c27c80e679d02849f71a53b4c76a3496e8bc3067b76f3dac513924f90ac3fa32a7c5da1c153de72db605656937586d923

Download Submit
memory/2068-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2068-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2740-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2740-1-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2740-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download