9345cf269479df07d83e6e5a677533d3749eec8ea6e3ae480ebd7433da24377b

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe
Size

62KB
MD5

9620191dd809cfa19bab8f8e0dd5b56f
SHA1

f4e569e5a30a609d85496304d2e6ce76f20e100b
SHA256

9345cf269479df07d83e6e5a677533d3749eec8ea6e3ae480ebd7433da24377b
SHA512

2b1913aaddcd8b6905ec5e6a978d91fe27dd52c93b809221f09ef8d970ce8d3fad4ba060b994de853449f4b042d5e85fb574dcee5b194a516e205911d983ec0a
SSDEEP

768:zQz7yVEhs9+syJP6ntOOtEvwDpjFelaB7yBEY9Su8F5mLZ5YS:zj+soPSMOtEvwDpj4kpmeLmv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1112	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2224	2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a000000012238-11.dat	upx
behavioral1/memory/1112-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2224-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1112-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1112	2224	2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe	28
PID 2224 wrote to memory of 1112	2224	2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe	28
PID 2224 wrote to memory of 1112	2224	2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe	28
PID 2224 wrote to memory of 1112	2224	2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_9620191dd809cfa19bab8f8e0dd5b56f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
d10c28aed5cb8225d56d8e4fcd77475c

SHA1
eac0a971458b0358575275ec3431fdee75f1ec13

SHA256
4fd8c879242e14b7f59659bf2ccee01179ee580b4821e1e42a405c9c73bdca5b

SHA512
04a09e05d9bc3797ff4e82b06edb38f71040d1d0929b9b79b943728f25c44b41b127b60cffe1f8ee41cee49e5ee9c3ea99a4de9fe8699d2614833a35d715a6c1

Download Submit
memory/1112-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1112-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1112-18-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1112-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2224-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2224-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2224-4-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2224-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2224-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download