ec8d34a9205e227e02325eb8a9695eb2be27ee31c9d83cf92792f5e1e3021cab

Analysis

max time kernel
152s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe
Size

76KB
MD5

acc3b2cec910db1c16842a8626b3c83a
SHA1

bfe00b16606da29e5f85e0b1bac7fc7da24cb11e
SHA256

ec8d34a9205e227e02325eb8a9695eb2be27ee31c9d83cf92792f5e1e3021cab
SHA512

c9cf42821a0596b51acef2388ad637c374051087805efefbf37c06b93588985879f6b3a584bb577e9df0bd46d9b57c3d7188fac96a0ff0c7e3134a84a90cfdda
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KujdI:ZVxkGOtEvwDpjca+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012265-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2576	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2576	2716	2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_acc3b2cec910db1c16842a8626b3c83a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
0d7153c32c09cabfb4ce179f9b774ff4

SHA1
c76be358cee47626d41f487ca2291aaf1c9185fc

SHA256
01d64e4d983ad1add10416b000e672d79f57417f488a4b2d7c757cc36981a2ce

SHA512
34a6a0de6694159f1ae118858c093481125b76d46faf2c081bb6c971177f2ad691ad856f76db0de7eba7e1f545ee5601c04163f563561340873fe0c5a13abf51

Download Submit
memory/2576-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2576-17-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2576-19-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2576-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2716-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2716-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2716-2-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2716-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download