ead75f750ea918822ed244723cd849a14373db425fa0021b83b1c86a15bf72f0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe
Size

120KB
MD5

bf6e465142a3e586481dacf51461cb81
SHA1

7cc071ebdaaa9b9d14f7ce6b8032b70cab8677cf
SHA256

ead75f750ea918822ed244723cd849a14373db425fa0021b83b1c86a15bf72f0
SHA512

aba060ccdb80ac7a195bb06fd24f0db77ca9debdab02e8f8b3ed34f5831d9ffc500ab145a4e26ba2a593a6d20814b082419255c0dfd610490e3af5d35276cc30
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUSr:vCjsIOtEvwDpj5H9YvQd2s

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2264	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2176	2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2264	2176	2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe	28
PID 2176 wrote to memory of 2264	2176	2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe	28
PID 2176 wrote to memory of 2264	2176	2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe	28
PID 2176 wrote to memory of 2264	2176	2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_bf6e465142a3e586481dacf51461cb81_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
120KB

MD5
2e37847da11d5950abdefada5de5fb11

SHA1
8866865c857a92ea3f52afb7f9ac190043f9d41e

SHA256
7ace49382c7a75522e725d26176ad20dc3885db08b18a4f2e130af222ea0e1a6

SHA512
3da00d1db0e59295b435433553abafc9bc8a3bc539a531d1aeb54e7ae39b2b293fbe8d816dafb6a22824187590a438c7032033a7955bd3e777e0376305b7d660

Download Submit
memory/2176-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2176-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2176-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2264-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2264-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download