70329ac875cdd3802d209b6dd10ddc337d97c0281e21c1b2364f8416faa3f395

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe
Size

54KB
MD5

92bdbcdfa17c207e06bacc7f7bf8b5fa
SHA1

1732be1630b7b1ba4f4478e195b01ff315ab53ee
SHA256

70329ac875cdd3802d209b6dd10ddc337d97c0281e21c1b2364f8416faa3f395
SHA512

5e453de9da44cf1a9569831f72b7adce7bcfaebe0309a1934a20688139d69773bf4462641dccc47d6c56713a58f1437fe6900fac0ee042f8a69662188b6e9e8f
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO5U0:ZVxkGOtEvwDpjch

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000144e0-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2512	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2592	2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2512	2592	2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe	28
PID 2592 wrote to memory of 2512	2592	2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe	28
PID 2592 wrote to memory of 2512	2592	2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe	28
PID 2592 wrote to memory of 2512	2592	2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_92bdbcdfa17c207e06bacc7f7bf8b5fa_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
be2ee274da712b20056bbd90f0c6f802

SHA1
de01b3877a51c68255d89875f00178b2d205cb3c

SHA256
06ed4d1c6c6c0dd3a52e2f38a06e986a1cb5c5bc8a63f1a92b4ab72c03ee4bf3

SHA512
bf38137a21dda5526a97dd153bd919e22f1e721513c7782b1c9ff2c1f3034bd1baeb6e258219538fcd5436dc49f547ee4cdb62c785006316cce4e93bbd058431

Download Submit
memory/2512-16-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2592-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2592-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2592-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2592-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download