3b86189e6e9363048be09afe838f5765c4c695525964757e93a5373b8153dd6b

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe
Size

60KB
MD5

f41c08d48e544e37bc22dd892ee9b50c
SHA1

a1fe0425e245093b62251403b06622d2cb7e668c
SHA256

3b86189e6e9363048be09afe838f5765c4c695525964757e93a5373b8153dd6b
SHA512

84236afe343d2394eae761434d391b3c0f2bf78fd39581ce0a6bc2a1bd287ee006f4bc0510da22dd6f9ff0b03a3bb6a97b07c18957c65a3d382cc39ea6a74665
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeoYPO+FwNrips:ZzFbxmLPWQMOtEvwDpj38lD/cMAT+grl

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224e-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2784	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1692	2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2784	1692	2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe	28
PID 1692 wrote to memory of 2784	1692	2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_f41c08d48e544e37bc22dd892ee9b50c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
e9ca51604a5002fcab26ea73764090f0

SHA1
000b68387eff01b0bda196c6fc071cf42e59b9c9

SHA256
f31cde92302517d2f5c42f98dd6aa570d9eb1a14d200126c70f35d67ad30693f

SHA512
34566fd78fe80850f76b714bc0013b11c45c08d0a9589da57ee696928b367fac129b27736001ee68e66b232d04897b045ac91709a6f8f54c4e19bf7084a31eb2

Download Submit
memory/1692-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1692-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1692-5-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2784-14-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2784-16-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2784-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download