b30f48a28567c986589440944aa76f9a5c27973f7883d4a866082b60e37be4c5

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe
Size

38KB
MD5

f6b57642b88d26cb0a05d6fb53cf96a2
SHA1

13eab2ca7f2d1938c7b1b9d10de90910ab469dfd
SHA256

b30f48a28567c986589440944aa76f9a5c27973f7883d4a866082b60e37be4c5
SHA512

24c9d438c831ee1d0d6eb71091dba30d8e7eac029e18dc33bfbc38ff8dc19af6b47edef79a1abb2c7e193b7f48a12430d51afd8ca765e33411311aa6438bc36a
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenB8vfN:ZzFbxmLPWQMOtEvwDpjLeSfN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012227-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2472	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
844	2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2472	844	2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe	28
PID 844 wrote to memory of 2472	844	2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe	28
PID 844 wrote to memory of 2472	844	2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe	28
PID 844 wrote to memory of 2472	844	2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-18_f6b57642b88d26cb0a05d6fb53cf96a2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
1a8dfdc05ac08d61b51f9678cd2dfc3f

SHA1
ba674ee9c28c7216fe74a2b7d5e159a4954d5c00

SHA256
bacc59d01262c16cf55a4d3be63efefce4e212b22ffb1f307d3a41a3d86fad97

SHA512
9341daa5dbd273d92d1a4bf32d6f032352c31c9d38265a5cfb11d5ce1245ded3e560aaf4583c38d6cfe4536b99c3b80bb9f5d9ce24ae26a7e31df61920c0231b

Download Submit
memory/844-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/844-0-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/844-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/844-4-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2472-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2472-17-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2472-21-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download