a5ebbc759480893da9c9c0c33ad9e0c8613a5f272ade0915a21b4dce3540a5a7

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe
Size

38KB
MD5

29f89b3ce7f95bdd0f595a9fa8697631
SHA1

7500953122eec5fd978367ecf0e2ffe0d96f15f0
SHA256

a5ebbc759480893da9c9c0c33ad9e0c8613a5f272ade0915a21b4dce3540a5a7
SHA512

d74df0ddf57e0c8a9e70b682aa4c36b885e28ae182cfee0e68d42cddf2df0fceda77ba1733709325eaa328374e2fdd98d70301859e537da1ce0cf73c379f8601
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQLLu:ZzFbxmLPWQMOtEvwDpjLeUq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e0000000122e2-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2744	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2744	1712	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	28
PID 1712 wrote to memory of 2744	1712	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	28
PID 1712 wrote to memory of 2744	1712	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	28
PID 1712 wrote to memory of 2744	1712	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
a3b993fcbb4244e32322cc834abe6771

SHA1
9b9ac57ea6af6e306a59553bf731731c006c50d0

SHA256
cddb86701ca0e6c3462bb5d93ebba3e3836f741f4125f78fa44e5389276d354d

SHA512
ca375355d62c9e08f59fde0569054b3b4bcc25adebe1c8445a9045ffd54fbc9eb393abca909f1323cc9a89fc6260fe0c86ab334379cbd84de58a1a064c1cbeef

Download Submit
memory/1712-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1712-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1712-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download