30233b3f67cb9cfe494e5b6cac57bc9bc2da978eced334fb728ac211bb921006

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe
Size

45KB
MD5

cf6f8555413fdb196933fb6376d7c284
SHA1

aa1e51085c3243f88da6c927fc1675b15ca4b18f
SHA256

30233b3f67cb9cfe494e5b6cac57bc9bc2da978eced334fb728ac211bb921006
SHA512

8fc2a096a3b1a60baa36b1bae34c75194f89e16123535533b72d1d7a1c0bd17673d8389d75a09e77f28f4c55de37a7d3c01325ece75ea9d467c6f323d03b3ad8
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsn:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1J

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012281-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1628	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1628	2132	2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe	28
PID 2132 wrote to memory of 1628	2132	2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe	28
PID 2132 wrote to memory of 1628	2132	2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe	28
PID 2132 wrote to memory of 1628	2132	2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_cf6f8555413fdb196933fb6376d7c284_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
29a5424946982effe4d9f0b55e3b2e0d

SHA1
89e0e62419d646e975317396af87002e1c4c8ee1

SHA256
66ee2f34c8684758f999ed8759326308c3b8639557b0bfd3e2d900dd0aa2dd3e

SHA512
0834a09fc577902035e6a2c4704e34762892984a25aa0d9ce8c036c94a0cd699a276c07a1281775a57f1aefd8c2ffc0568a36eb60631a16362ec4dad7d1c64ff

Download Submit
memory/1628-15-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/1628-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1628-18-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2132-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2132-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2132-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download