43eb21984f57115c0d652b957ceb6098c6679853906c68fe9434bff2d312c66a

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe
Size

39KB
MD5

085f1bc112747037121838b6b0be6160
SHA1

aaefb1e48b5ff3734c7b075a886a89fbe88a3eb5
SHA256

43eb21984f57115c0d652b957ceb6098c6679853906c68fe9434bff2d312c66a
SHA512

ce2f37145ddf04f50e4cbaf67ca263e2148e0e1d87c6e5f6c3fd67aa2da16e2b1e03aeaa0630ccd64bf573008f741ceb081ac8ecd95bd9b7982a4f45f4694a20
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4qnpXX:fT+hsMQMOtEvwDpjoIHa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001226b-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001226b-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2152	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2944	2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2152	2944	2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe	28
PID 2944 wrote to memory of 2152	2944	2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe	28
PID 2944 wrote to memory of 2152	2944	2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe	28
PID 2944 wrote to memory of 2152	2944	2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_085f1bc112747037121838b6b0be6160_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
768ac7aa9324f83b13e454b29f61bee4

SHA1
19607f3141ed073bc035a82c3365e94b2d513415

SHA256
e20df018504db2548653a99812b13c6bdd87d61b93b07045157c0979a6c8c6dd

SHA512
d3a9c0fad84d458d849d9ae06a490c8f32b9aea33d8c52340cd8ead43395e6bdbc9b906025d33751465cf09dac09be0fcde486b1215edce9fff2e371306321c9

Download Submit
memory/2152-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2152-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2944-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2944-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2944-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download