25dd3df7a10f7ffe416ed4a9b8e85be21c6826218018e2b7fe06e09752987598

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe
Size

60KB
MD5

665930fbe35802c36e0a5e1e2a17a68a
SHA1

56e261c866c31b5f82e643889a4f1f60fe43b4ae
SHA256

25dd3df7a10f7ffe416ed4a9b8e85be21c6826218018e2b7fe06e09752987598
SHA512

436f8348d4cc4ebf983aaf8e9d524abcf825d16698bc68133991e83f0911e02e44dd73f476264af9169c3b66e5c5abfc4f307daea5efb8c1c3a037faa2701dd7
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJT/Ek:ZVxkGOtEvwDpjcOn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012241-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2056	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2056	2020	2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe	28
PID 2020 wrote to memory of 2056	2020	2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe	28
PID 2020 wrote to memory of 2056	2020	2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe	28
PID 2020 wrote to memory of 2056	2020	2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_665930fbe35802c36e0a5e1e2a17a68a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
3608dd001c01a23b269531ca99de1466

SHA1
da4adf4cbbcaa00d8b9916716e6e7474e9e9cf1b

SHA256
3e99e255f96febda27b4ffca90478916f81feda60381e88191a6a211fff14a78

SHA512
c97b82ac77ff87f2451e7d9bcbdbbb7deb358046726b3253a13df1912dd07ed238836c0e3de752da3df4e303e5762b5f4a191c24900c5f4b44294c207275cea6

Download Submit
memory/2020-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2020-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2020-2-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2056-14-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2056-17-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2056-16-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2056-24-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download