966fea44fe1e8994c36f5c1415a2619f5524f21b687397c4b920f380eeedb54d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe
Size

54KB
MD5

86c235b66d9b2482e13a0a2da7d046f2
SHA1

00e6d08840cdb2b776e5d4cb0f16a7ab136ccfdb
SHA256

966fea44fe1e8994c36f5c1415a2619f5524f21b687397c4b920f380eeedb54d
SHA512

11dc76e04dc7550343add9199de011ce076fb066664147ed1f1d7f3299a9f2a198d8457f9653faa2621c07109c0ad117c6278d69c259d8a9dd2f313068419151
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO5Uoj:ZVxkGOtEvwDpjcZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014284-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1688	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1688	2040	2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe	28
PID 2040 wrote to memory of 1688	2040	2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe	28
PID 2040 wrote to memory of 1688	2040	2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe	28
PID 2040 wrote to memory of 1688	2040	2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_86c235b66d9b2482e13a0a2da7d046f2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
d69831c8080fb461e9fde50878a7df32

SHA1
c983d943d93c423216047d88c29ba36b1873f2c5

SHA256
3824c2c58436a3b2e63be1c5bc6e580c52d96a660334ad9e088676fcdda78a9c

SHA512
69de5a4b83fa3b83f435673bb34a86f2eb7eda99aacf31ddd486a3acb875235794b903694a63dc5b2009a3a784ac7bf77fb0edb8e801e4e429e26df8ffb61ed0

Download Submit
memory/1688-24-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1688-23-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1688-16-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/2040-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2040-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2040-8-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2040-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download