b7b9efdef6c37826d6f066dba83b915234e68c3958ae6bd69c142897a0633480

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe
Size

66KB
MD5

26a5c2c506592fda6c1e1b0917869400
SHA1

a098e85bfe2ef37f298797d0b81115150aa4e5f0
SHA256

b7b9efdef6c37826d6f066dba83b915234e68c3958ae6bd69c142897a0633480
SHA512

bdfcdc6265cb31ae9391594248d491374cd035f918dd044b893a02503bb187e43e72490e4f467262e4d6a60031048bc8f64bf6f3d506e0f98bbaa539b24c9433
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3hvLcbVq:ZVxkGOtEvwDpjcawk

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224d-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3036	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3036	2992	2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_26a5c2c506592fda6c1e1b0917869400_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
66KB

MD5
6b900fa91017b63d5813eff432937434

SHA1
4a9314209bf1c5e6575b3aeca3be7d6ab1fc9dcb

SHA256
2d1ac3eb79ceefee4e89c34c01cd7994cbe42857573d86783b6781f51297e75e

SHA512
52aa35103c4963e9fd9b2d9d5ef04644103dc73787329981b9882d7c402f9dd658104f9b3041243c912c6eeb8b8064a00b9461e277016830bba17d16e5cd7aa6

Download Submit
memory/2992-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2992-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2992-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2992-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3036-23-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3036-24-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download