6fac70edfbf278ef5311318037d44a53cea84ac3d4ccf03286917afebe17d774

Analysis

max time kernel
252s
max time network
286s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe
Size

43KB
MD5

edba3ed65f19446bd92fac730c8f5db2
SHA1

581750b3392f9620376a51df25964632fa7a7f41
SHA256

6fac70edfbf278ef5311318037d44a53cea84ac3d4ccf03286917afebe17d774
SHA512

ec9288f7a717d4df28e87b90b0d17d911daec507a37e06d709b10960a68c129e97f7fec34d0d18261219dc7c396ac4e2479850e5b66c00920f021adeed2b1d63
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wso:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0004000000004ed7-12.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2956	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2956	2912	2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe	27
PID 2912 wrote to memory of 2956	2912	2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe	27
PID 2912 wrote to memory of 2956	2912	2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe	27
PID 2912 wrote to memory of 2956	2912	2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_edba3ed65f19446bd92fac730c8f5db2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
43KB

MD5
7b0ddb561e631a2c258b1fa5b3f8eab4

SHA1
21412c65f0ab4c52ca9a48392241d1a642cddbf7

SHA256
4a0baa78fd02c409a190563b95207168c3c6a8d2f259115307559b8b1a213083

SHA512
7068aa01dbebfcde90aace90f97349752a80dcda24d73f73fa9febf8b8b2f24b5bb62b228b055569352486794b0fe23ce0862ee36c49459567c0967c6f907de0

Download Submit
memory/2912-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2912-2-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2912-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2912-4-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2912-10-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2956-17-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2956-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download