d31f4ae972881e90bfd4ac614e7710fc4387643df0107b076a74fec40d7525fb

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe
Size

74KB
MD5

a116968575ff1b9e1db2d20103ac4639
SHA1

5df54a5475df9adaac889eca19c4b08229c69700
SHA256

d31f4ae972881e90bfd4ac614e7710fc4387643df0107b076a74fec40d7525fb
SHA512

01498556e41e30d9107692cd0a7509ebe1e8ea8ffca37616e9835175ec7ccf6ec192f343520d081cc4cb95609d637e25b8516541396674df05183e001d2177a1
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KFS:ZVxkGOtEvwDpjcaL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012185-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2740	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2124	2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2740	2124	2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe	28
PID 2124 wrote to memory of 2740	2124	2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe	28
PID 2124 wrote to memory of 2740	2124	2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe	28
PID 2124 wrote to memory of 2740	2124	2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_a116968575ff1b9e1db2d20103ac4639_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
d3c614806fcb8cffe5b8803aa796233c

SHA1
b445f04a719745c9fc9c6393a3d37656b42e2fd6

SHA256
a374785a1f6508988415bb7a61103574704d109a5237ea2aac885abf6d91b834

SHA512
fe95b7e4917e85fc7221a9a30da19685846ba3a447d9b6c63510704ac939a355e535a11414862ebd80a966487ba3e2ecb9e698e5187f687e9a1794f364d35cf6

Download Submit
memory/2124-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2124-1-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2124-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2124-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2740-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2740-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2740-19-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2740-25-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download