b13051085bffb40ff1ba8cfbfe45289af7e98d6ec37a7a8549524bc4ec64a77d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe
Size

39KB
MD5

e43a874a6e028e8ad128757dc64bee6b
SHA1

1643bcb827f7b0b3c84e77ec92ef28e07bffd8d8
SHA256

b13051085bffb40ff1ba8cfbfe45289af7e98d6ec37a7a8549524bc4ec64a77d
SHA512

97794e7d7d7350939f01778b87d6a97cb58179594b05e7821020c364e68d919586203ab419346819c8bee9039d5c68565a9f4b751e5e3b6f6f5c6098a18f1516
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQL8Mr:ZzFbxmLPWQMOtEvwDpjLeUtr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000122be-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2368	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2368	1512	2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe	28
PID 1512 wrote to memory of 2368	1512	2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe	28
PID 1512 wrote to memory of 2368	1512	2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe	28
PID 1512 wrote to memory of 2368	1512	2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_e43a874a6e028e8ad128757dc64bee6b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
3e904e3fd93b3e3f2b62fe8591230605

SHA1
f262c665f5c65a2a131662b841d1a8ec43073b9a

SHA256
534798ce7918814546cfdab2a2253b087b71c4a62eb66513a181f2aca859ec64

SHA512
f3468392daca4f6756bba78595cf5632e0b0cf68c2cd4d46bc9130074f3a29b205bfe356ac2018f42bc281a6125e6077ef558d2320224d534ed793d4b5f6e66d

Download Submit
memory/1512-1-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1512-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1512-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1512-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2368-16-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2368-23-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download