a10cd8aaa54eaa4e0f23a88effcb1a2116f443c05de2a1e120ef5c4d4d362c6a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe
Size

50KB
MD5

571f65c8da4286e09d5539a726c594a4
SHA1

6b70d1b6264e4a63e9781d7fcca9a798a0e72170
SHA256

a10cd8aaa54eaa4e0f23a88effcb1a2116f443c05de2a1e120ef5c4d4d362c6a
SHA512

2662f473c524145e698b023732a0e3fcea49541ebb3a5c5709e8de57efa24c840f02abe141fb5d6dfc4624216c2db519df6a01179ea2024e6174a91bc96f423c
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0n1L:vj+jsMQMOtEvwDpj5HczerLO04BML

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016a29-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016a29-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3036	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3036	2060	2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe	28
PID 2060 wrote to memory of 3036	2060	2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe	28
PID 2060 wrote to memory of 3036	2060	2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe	28
PID 2060 wrote to memory of 3036	2060	2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_571f65c8da4286e09d5539a726c594a4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
5c2d5dc4dfbf6722f992757105446596

SHA1
e65c384fc0e80220c0e3293fe5d94406d2877d3f

SHA256
d239ef373843900bf0d0f9132d5dcc7b87614f485d2d15ba98fd2a415e3d64c5

SHA512
371486f3d2eee053842992cdf0d48b601b8e0cc0f0e978a0ce1251f362d6eb56c85fdbbe4594a5db063512c4aace0c96fc93cf90a45a4cd469c5ea3e8dfbe125

Download Submit
memory/2060-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2060-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2060-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3036-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3036-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download