cryptolocker | 724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe
Size 352KB
Sample221206-ll9p3aee34
SHA256 724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425
MD5 a93d75cb6f72c1847c3f5afc9c94bbbb
SHA1 016409e124f98d565c5a5fa3d3b2428152259df7
SHA512 ad79d2f68b0b2036794bd047256ed8f9eccd497db7701b5f1b80e7b4388a28774edfa50abf846427aa81b833c0cd970dcd4bd468b05f5d943f5a8f1baa2c00f5
SSDEEP 6144:Y3Q7OlkZayQFnE0oqCtBK/OLyUsn07wWQshOBqSTeaybz+ffB:v/rWZoqf/OCPIOMj1P+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker

Executes dropped EXE 2 IoCs

pid	Process
1420	Avywuixyxmexxtr.exe
1280	Avywuixyxmexxtr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Local\\Avywuixyxmexxtr.exe"	Avywuixyxmexxtr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Avywuixyxmexxtr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*CryptoLocker = "C:\\Users\\Admin\\AppData\\Local\\Avywuixyxmexxtr.exe"	Avywuixyxmexxtr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	Avywuixyxmexxtr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1420	4640	724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe	80
PID 4640 wrote to memory of 1420	4640	724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe	80
PID 4640 wrote to memory of 1420	4640	724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe	80
PID 1420 wrote to memory of 1280	1420	Avywuixyxmexxtr.exe	81
PID 1420 wrote to memory of 1280	1420	Avywuixyxmexxtr.exe	81
PID 1420 wrote to memory of 1280	1420	Avywuixyxmexxtr.exe	81

C:\Users\Admin\AppData\Local\Temp\724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe
"C:\Users\Admin\AppData\Local\Temp\724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe
  "C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe" "-rC:\Users\Admin\AppData\Local\Temp\724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe
    "C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe" -w260
    3⤵
    - Executes dropped EXE
    PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Avywuixyxmexxtr.exe

Path C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe
Size 352KB
SHA256 724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425
MD5 a93d75cb6f72c1847c3f5afc9c94bbbb
SHA1 016409e124f98d565c5a5fa3d3b2428152259df7
SHA512 ad79d2f68b0b2036794bd047256ed8f9eccd497db7701b5f1b80e7b4388a28774edfa50abf846427aa81b833c0cd970dcd4bd468b05f5d943f5a8f1baa2c00f5
SSDEEP 6144:Y3Q7OlkZayQFnE0oqCtBK/OLyUsn07wWQshOBqSTeaybz+ffB:v/rWZoqf/OCPIOMj1P+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Avywuixyxmexxtr.exe

Path C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe
Size 352KB
SHA256 724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425
MD5 a93d75cb6f72c1847c3f5afc9c94bbbb
SHA1 016409e124f98d565c5a5fa3d3b2428152259df7
SHA512 ad79d2f68b0b2036794bd047256ed8f9eccd497db7701b5f1b80e7b4388a28774edfa50abf846427aa81b833c0cd970dcd4bd468b05f5d943f5a8f1baa2c00f5
SSDEEP 6144:Y3Q7OlkZayQFnE0oqCtBK/OLyUsn07wWQshOBqSTeaybz+ffB:v/rWZoqf/OCPIOMj1P+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Avywuixyxmexxtr.exe

Path C:\Users\Admin\AppData\Local\Avywuixyxmexxtr.exe
Size 352KB
SHA256 724799e37d6b47dc099caea7aabb0c1246a5041537d425601639d551e42bd425
MD5 a93d75cb6f72c1847c3f5afc9c94bbbb
SHA1 016409e124f98d565c5a5fa3d3b2428152259df7
SHA512 ad79d2f68b0b2036794bd047256ed8f9eccd497db7701b5f1b80e7b4388a28774edfa50abf846427aa81b833c0cd970dcd4bd468b05f5d943f5a8f1baa2c00f5
SSDEEP 6144:Y3Q7OlkZayQFnE0oqCtBK/OLyUsn07wWQshOBqSTeaybz+ffB:v/rWZoqf/OCPIOMj1P+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1280-147-0x0000000002410000-0x0000000002475000-memory.dmp

Download

memory/1280-146-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/1420-142-0x00000000005E0000-0x0000000000645000-memory.dmp

Download

memory/1420-145-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/1420-141-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4640-136-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4640-140-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4640-132-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4640-135-0x0000000002570000-0x00000000025D5000-memory.dmp

Download

memory/4640-134-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4640-133-0x0000000000400000-0x0000000000465000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads