20846f42ade7dea39f535a4e23527458445addae60b5c91d458fbcdc787ef96c

Analysis

max time kernel
163s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe
Size

45KB
MD5

b897f6bc90a94c71ca963f812f1939c5
SHA1

f6d0900dab306ecd2ac835a30377ed8bf66a1e68
SHA256

20846f42ade7dea39f535a4e23527458445addae60b5c91d458fbcdc787ef96c
SHA512

b79d3c76dad8fa608ba22a0d29e8711bfd9eba38b674cb223ea367937945c8389774a8a7da941cc2121d242e5b1f4b967279326c43c5d6608b1c06ae35702182
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUqox:vj+jsMQMOtEvwDpj5Hczer5izox

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012274-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012274-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2036	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2036	2192	2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe	28
PID 2192 wrote to memory of 2036	2192	2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe	28
PID 2192 wrote to memory of 2036	2192	2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe	28
PID 2192 wrote to memory of 2036	2192	2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_b897f6bc90a94c71ca963f812f1939c5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
24a67da393403683d24f865c9f9c13d0

SHA1
63a5c5857f31e0393f97f84bd70bf33c9a9ff3c1

SHA256
fab38178f8b5bb459cbf28f263b6f88aa0edc17e07b99d0546f8a9ddef13702e

SHA512
785e387da1fade8202eccfe58d730ab0fba574019a67a445d20a847dfa00a206f76eb52050ea97337ab9adfac4792df8dcb98b9353d24ac8638947b5e7d246bb

Download Submit
memory/2036-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2036-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2192-0-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2192-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2192-3-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download