ca30f4ad1d14938fcb8dc63823752c6b9bc10014b30e871f55a3089d2ffc7e3b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe
Size

45KB
MD5

a2e44b4b6e77e7a100b7a23c7bb7e8e9
SHA1

67d5ce7e3e6f8c6538b2ba47020c732eeb170472
SHA256

ca30f4ad1d14938fcb8dc63823752c6b9bc10014b30e871f55a3089d2ffc7e3b
SHA512

cdfaf754b8ca022b444786e845fddb696562c1723751e3b460492e8beecc1cc2af779c2904116d98b6f8c0bcd4caf577b61255c8f39418183167b96ab908b4b3
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUr:vj+jsMQMOtEvwDpj5Hczer5ig

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015f01-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015f01-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2220	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
760	2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2220	760	2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe	28
PID 760 wrote to memory of 2220	760	2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe	28
PID 760 wrote to memory of 2220	760	2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe	28
PID 760 wrote to memory of 2220	760	2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_a2e44b4b6e77e7a100b7a23c7bb7e8e9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
0a90e6c1bfbd7f0758b53ddb060ca422

SHA1
a91b3d6008d9581fde447492432a53f5c53b054a

SHA256
00c42ce012a478f44b6d33074a2a151011971aca6d06f40697f1d64f0c94090f

SHA512
e7e845b0cf1a2636fd8310c00c2db0fc6b90cc40039a4ecd0b6e482fdbdc7236dd367ac249608b325936b9027ee8342205af985a27f2b6db20e053d3426954dc

Download Submit
memory/760-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/760-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/760-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2220-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2220-22-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download