3863fe28769407fa0e6d1c7a7d9e6451b30ec04686ec7c7fd34d6eccbfca08f8

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe
Size

41KB
MD5

784f0d056258ba5168d232f4053dd4b8
SHA1

1f0dccc7a6a4cc93f8d83351d0f762b8e3d28d10
SHA256

3863fe28769407fa0e6d1c7a7d9e6451b30ec04686ec7c7fd34d6eccbfca08f8
SHA512

73deec7a3cae3c1dcebeb9e53abed4303a15365b0f09507a926fa0e7c1d56ce4e41cbee9915fa21ed1c6f4bcd94b9e11265e151f9094137bc30621edf0bba4f1
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQL3bTa:ZzFbxmLPWQMOtEvwDpjLeU3S

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012287-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2740	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1932	2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2740	1932	2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe	28
PID 1932 wrote to memory of 2740	1932	2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe	28
PID 1932 wrote to memory of 2740	1932	2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe	28
PID 1932 wrote to memory of 2740	1932	2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_784f0d056258ba5168d232f4053dd4b8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
41KB

MD5
6b1ed550d2dd827db4b7c23f80cc9e0e

SHA1
3dabfe5713ed49a79c5e97267a9e82b8a8995d24

SHA256
e50dca98a2f4ff207b78ed131a31fc4a9a8a8b089533d8cb3b18750883dc7909

SHA512
36e8aa145660c474f37a285bef5b0d5629a52da7e99c5bb73227905edea0e1607fc30a7c13e72a5a37d9ecbeb29325b6c1aa63bef0e81192106ecd5cb3f20ca7

Download Submit
memory/1932-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1932-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1932-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1932-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2740-15-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/2740-17-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2740-19-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2740-25-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download