a0c3c3e085a5ed25ae0aba140a1807edf1bde2662026a758e5f6d7b2d66c2dbb

Analysis

max time kernel
134s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe
Size

119KB
MD5

edd3b101a076577beacdfa30c886366e
SHA1

8fbe731d3b643c1578ef0f49478406f428fda429
SHA256

a0c3c3e085a5ed25ae0aba140a1807edf1bde2662026a758e5f6d7b2d66c2dbb
SHA512

f07f5e042bb6681a59c20bc89ccb78dc476c6dbca7dee08d6e40d4653376182583d65bbb34328eb378d960fd0b493ce11fb8f633057919d3b41c32ae52f45157
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUS/:vCjsIOtEvwDpj5H9YvQd2A

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001223d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001223d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2040	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2040	2236	2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe	28
PID 2236 wrote to memory of 2040	2236	2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe	28
PID 2236 wrote to memory of 2040	2236	2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe	28
PID 2236 wrote to memory of 2040	2236	2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_edd3b101a076577beacdfa30c886366e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
120KB

MD5
43430657733550318f7b8bc2c6bdb03c

SHA1
ee741b7c91d91282e313fac6bcf7038f94f2343c

SHA256
0af77512a43d8aa290fba063055ee9d90db35ac3b41afd94514cc536a0580e9b

SHA512
eba5378e3060b3a04d77bb8c11700afc63c8a53b390e69ae5ae5b7f8a7628bf260748ff2e376be6ce30464a8b8f7dc1b424930ca90879543b615ac1d995418d4

Download Submit
memory/2040-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2040-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2236-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2236-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download