48c269ab3fe023d4c1ea5245d906ead517170fdd591b8cc698dab72c365f71d8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe
Size

64KB
MD5

cfb604120e75d3d4688ab822c3c397c7
SHA1

70a704136d3f5e56f407583cd3d1337eab138e3e
SHA256

48c269ab3fe023d4c1ea5245d906ead517170fdd591b8cc698dab72c365f71d8
SHA512

800786bfc0b724f4fa6b3e82507691d20f0bbcbd2fbcf0dcd1302fcdedd70ddedf4b6e4924af175fcb8650eb4a1f3adf50c02c66eb94b3289ddb59774f45b5d9
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3hvLcbV4N:ZVxkGOtEvwDpjcawo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2700	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2700	1320	2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe	28
PID 1320 wrote to memory of 2700	1320	2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe	28
PID 1320 wrote to memory of 2700	1320	2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe	28
PID 1320 wrote to memory of 2700	1320	2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_cfb604120e75d3d4688ab822c3c397c7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
2486122409184095cd59e92f2ed8ddec

SHA1
a2bb00a498c90fbd37ec5c1cea9bb4ded344b718

SHA256
caa1932526c86504ba2aecea42153faafa7860a817440971f95635d20b18510a

SHA512
ec295ba3ac62774702daab582d3732b7c2ecfaa8fae6c7befe151151cc0d58b410c4691275896c5e62bdb140a4a298806550d2dd9eb51738b11f42b6a6da402d

Download Submit
memory/1320-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1320-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1320-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1320-7-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2700-15-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2700-17-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2700-21-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2700-25-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download