13a7827e4afe57978e85007fed6f1671c7564f80868c7f6f122850a95f9a2155

Analysis

max time kernel
139s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe
Size

87KB
MD5

a5ffe49a729b912ba3466e6856682e6a
SHA1

fe38aaeb79ecc57a27fe0955c783c142aca58987
SHA256

13a7827e4afe57978e85007fed6f1671c7564f80868c7f6f122850a95f9a2155
SHA512

de85c09e8c93259dabf363dfa9c56e8e85d5130da414bfee7091c9f8aafa1e7f7ddf41811620fdf574dc7196bdeead8bffc2cbbcebdfdc7052a4637bac207ea1
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjN:zCsanOtEvwDpjo

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2472	2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2472-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000012270-11.dat	upx
behavioral1/memory/2472-13-0x0000000002800000-0x0000000002810000-memory.dmp	upx
behavioral1/memory/2472-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2684-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2684-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2684	2472	2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe	28
PID 2472 wrote to memory of 2684	2472	2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe	28
PID 2472 wrote to memory of 2684	2472	2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe	28
PID 2472 wrote to memory of 2684	2472	2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_a5ffe49a729b912ba3466e6856682e6a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
f3f158a60f0191b48230093dbb3ccec6

SHA1
877f858e0308bff0a1900e009248fa96fa32e725

SHA256
90fbeb10d536ace685edbb1d3e0df29fab1d5ef611b5e2fda83d3f1728540dcb

SHA512
1c6e08d8e061d98b63efb23e3bb3588962c57d4a84760b64bf3d8a848d487125d69b54d4cab12d3b52c48ae611e9c087c430473f6203420725c06b9f6a0f0bd1

Download Submit
memory/2472-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2472-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2472-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2472-4-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2472-13-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/2472-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2472-27-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/2684-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2684-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2684-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2684-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download