d448e96481e826f6a851bfd9ac5240338c6cef88a462d81170b5151f5ff05be1

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe
Size

74KB
MD5

7c4bdefa6b97e50e5bfe32232143a8fd
SHA1

1fd9662617c00c0684fd6274d90ceb525ac2d215
SHA256

d448e96481e826f6a851bfd9ac5240338c6cef88a462d81170b5151f5ff05be1
SHA512

e97c6540bcfb62bdb516db2d534d29f6c479ca26027a571d5f2ad086c5512e998a6cf6407ce00bab1319cf15f9ec9a442f30361e0ced29372ff08f7ab9b922bf
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KuF:ZVxkGOtEvwDpjcax

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000139e0-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1968	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1968	2004	2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe	28
PID 2004 wrote to memory of 1968	2004	2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe	28
PID 2004 wrote to memory of 1968	2004	2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe	28
PID 2004 wrote to memory of 1968	2004	2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c4bdefa6b97e50e5bfe32232143a8fd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
ed9bb7acfdff5995fc9a0ab61350afd4

SHA1
7b8476189953141979b3a76a32a3aeb4ff136619

SHA256
6bdb7b510291c47c43b9364c8ff6029212b76f481d6f9c2171e1e8188742f44d

SHA512
87d06fc53528b72e99398b96d73092403d62cd0b1b66ce1bfd6986e5c49de4eec26aa2aef87232026a914fc6e33dfbc2725efc9bafea1b9c4e2e7f74148f9cba

Download Submit
memory/1968-16-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/1968-15-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1968-18-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1968-24-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2004-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2004-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2004-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download