abe993c6928b05f4c038d35444da06714cfbd19177574db7a67f580a1fdeb82c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe
Size

46KB
MD5

63e39df00fda598b12ad9a5bdf0cbe10
SHA1

b0e5b171b1a6e6ccaa7622b796e421b53ed50322
SHA256

abe993c6928b05f4c038d35444da06714cfbd19177574db7a67f580a1fdeb82c
SHA512

eaf934fdc7a020ba2cc3be42ee19820e66f27ef2a53b20afa717e5ada9b58f7e2b93f9c4ec6ff1adebd0e79a4f7d5fb4234e52516421cc277e4bb3e2766f5828
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1ws/:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224a-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2936	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2936	2076	2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe	28
PID 2076 wrote to memory of 2936	2076	2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe	28
PID 2076 wrote to memory of 2936	2076	2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe	28
PID 2076 wrote to memory of 2936	2076	2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_63e39df00fda598b12ad9a5bdf0cbe10_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
03e6627b4f241a3336dbb1216dee3b87

SHA1
948c2e752c894866c9ef2f701062ceb4eb1dbb7c

SHA256
ea35096f15bf09274ed0e0f9e71a24254dd35c33f8bbd467625b923384b4bd5b

SHA512
bc79a96a0bf2fc78ed623b6eb39030843d16bea6b03438f6a781817c098c7512a569a0f040d0a12214726487e851d665b1e72d411e7903387f91467ea57e7433

Download Submit
memory/2076-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2076-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2076-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2076-6-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2936-15-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2936-17-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2936-19-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2936-25-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download