00252130259466750a023dbbc70710e21373c826af84a9985cd9ae39b49867ec

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe
Size

53KB
MD5

f3d4965a9f32cd295d03a0b5d8800f2d
SHA1

5cf51953e3eaa7cb1d4ce9a18ca5dc77f1f81fa1
SHA256

00252130259466750a023dbbc70710e21373c826af84a9985cd9ae39b49867ec
SHA512

76217372b56e87f480dcede0539ace81d2aeb413cfd9feb3b261116ef5395c83f81c3a889dbb4d1d7836760abb0ca373d2e3a104ca5881c1c662ed61edc6bc90
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO5US:ZVxkGOtEvwDpjcb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012707-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2976	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2976	2912	2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe	28
PID 2912 wrote to memory of 2976	2912	2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe	28
PID 2912 wrote to memory of 2976	2912	2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe	28
PID 2912 wrote to memory of 2976	2912	2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_f3d4965a9f32cd295d03a0b5d8800f2d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
8ea286d2597a25b931649020d6e93360

SHA1
9aa6c366755cc45111a9e53743b3665160b4ae54

SHA256
55b70a1ceb92017b9596fa5e1d72dacaa3046bfd57791949f9445caaae819e96

SHA512
512ef1d4390acef7324a2908b00953052cca425ad816151907278b376c3d21482e2784b82df5dacfdd4cca3c1a81c467ca4d453ab54f2700d1987910a7fcc2bc

Download Submit
memory/2912-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2912-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2912-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2912-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2976-24-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2976-23-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2976-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download