82c204f256fb843a8b733d89462aae0352d5572ad85e3702a6498ccbb7ab7111

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe
Size

76KB
MD5

e891805ce47e8ade6edb73f08477ae21
SHA1

5673afc08e97a8585391652b61e202d552e55a9e
SHA256

82c204f256fb843a8b733d89462aae0352d5572ad85e3702a6498ccbb7ab7111
SHA512

b5005731ad360c56256a1885c8385fd8bf5e6951c40ec0adca904a34cec2fcd0c4a2b633fcc5c88f242d50a3af342083979bb8af78871e9972c61cc8100294d7
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUU:ZVxkGOtEvwDpjcag

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000122ee-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2632	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2632	2164	2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe	28
PID 2164 wrote to memory of 2632	2164	2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe	28
PID 2164 wrote to memory of 2632	2164	2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe	28
PID 2164 wrote to memory of 2632	2164	2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_e891805ce47e8ade6edb73f08477ae21_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
1e7f25f41d1d6573848ef46fa2717d54

SHA1
e8ff538b12ba00d03015e90a699925f95b061d37

SHA256
38ffbb6791cba0bc71b0660bddaa8667ed10dd26304758f49fafd59e54a1f0e4

SHA512
54f028b3acebc7702b79e12eda2fc5f3fe6ff7af30bba88b1b993cbbf90727366bc0cd1a8b40b3bbd5c5caf8a422de40759c7be834da4fa919d0455345bdf311

Download Submit
memory/2164-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2164-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2164-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2164-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2632-17-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2632-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2632-24-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2632-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download