2cabecd05820874e6cf2ac360c30c008ab236e9cd7005b47764e9fff206409c7

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe
Size

65KB
MD5

3bbd50ad4c3ad38541b07164ca5f6b63
SHA1

8f6fc137bc3e73f6a430eab3b2681dc4c32ed350
SHA256

2cabecd05820874e6cf2ac360c30c008ab236e9cd7005b47764e9fff206409c7
SHA512

a90f3f87ab0fc3c21c0302cef753d3a715defabe1f92980c6415ee309470355657b11b3e50325e7aead809a32d02815e5e4f0a10346b41732573a980118e2ca2
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3hvLcbVB:ZVxkGOtEvwDpjcawb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012252-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1428	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2484	2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1428	2484	2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe	28
PID 2484 wrote to memory of 1428	2484	2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe	28
PID 2484 wrote to memory of 1428	2484	2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe	28
PID 2484 wrote to memory of 1428	2484	2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_3bbd50ad4c3ad38541b07164ca5f6b63_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
507d0dd6ed518a4d10765a08ab40485e

SHA1
ecfcd9233bcc1b9df5284a1bd156144a8a1ae1b7

SHA256
133b4dbaf6a930a7e54d1072e6355cb971d07bbfe819f7fbbe190dfe4cd2e24d

SHA512
15d4a5813674a27efeec62a4849f98b469b215c96a516a1c560f71a1aaaf692d8cb98970842f7e9e9093f8e5b2b23d0f2542ded9345efbddc371b24d16de3c24

Download Submit
memory/1428-14-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1428-16-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1428-19-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2484-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2484-2-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2484-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download