eff0866581843936b98cf0f7d054afd634e5471e98f103136d112a9a1112f8ec

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe
Size

81KB
MD5

0f220732246a7da0b2c04f0c64df65e6
SHA1

f063d8d34495012fd3f97614a36c4c367ecea479
SHA256

eff0866581843936b98cf0f7d054afd634e5471e98f103136d112a9a1112f8ec
SHA512

efc4e8c9de8980545c0ca5b24da214b13eb77f093d5ad58c6a1e2456d103cc426d90c4da8d65e948863e2d326934d71402e39cee0c09488bd6c56d90864ea5e3
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNqF:vCjsIOtEvwDpj5H9YvQd2k

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001227c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001227c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2836	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2440	2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2836	2440	2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe	28
PID 2440 wrote to memory of 2836	2440	2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe	28
PID 2440 wrote to memory of 2836	2440	2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe	28
PID 2440 wrote to memory of 2836	2440	2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_0f220732246a7da0b2c04f0c64df65e6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
a5cf77e4c4d3c5946d5ff52aeaceaa64

SHA1
940c2bd47455984e8e05f27c00388615e2fce2a7

SHA256
e8a0fe0a40543c20f45dbf364c52744b597b53e0b5f22475d09100a1e86c8ce1

SHA512
3d117500327ccd3d7e9ac36ff85f5c3e62856b04d999676104c6fdcddc8007ff96b9519e1c7e3a3558e1c3a0899c857c4149eeb0a174c845056f1645eecacf00

Download Submit
memory/2440-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2440-1-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2440-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2836-22-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2836-15-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download