a8f3cb95fa8e9204310c7643cf4d8826d6fa6190d66b1904180b8baee646ae85

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe
Size

40KB
MD5

313daa68a68444ad7ad298995586807c
SHA1

1c9f17bffef4316513e1e11f53cf3d05176b7016
SHA256

a8f3cb95fa8e9204310c7643cf4d8826d6fa6190d66b1904180b8baee646ae85
SHA512

ff9b1cd48006cf057ca983677ed4bc202bf3578cab923dd7edccff9a022d62ff6b3214ac5822ba1e21303067273df2ae5f44a8c18888d2ca36098ab29fd96995
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuD+M:ZzFbxmLPWQMOtEvwDpjLeJAsKcR

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001269e-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2624	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2336	2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2624	2336	2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe	28
PID 2336 wrote to memory of 2624	2336	2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe	28
PID 2336 wrote to memory of 2624	2336	2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe	28
PID 2336 wrote to memory of 2624	2336	2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_313daa68a68444ad7ad298995586807c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
40KB

MD5
b1f8ca81a9aa5e0ad19aac8bf7998672

SHA1
c641fce7d2517823de9dc5f07aaa1a549dfac057

SHA256
832c9184baef80a71c3afebe7e160d1ac253c3c693048f40f019a45110ef0c9e

SHA512
c6337047af4ddaf779bf5d8fc5007a1e2d72d440cc08df4ec32fb3321a329f5725f2a0978076640166bbc4aee8dd71c3fa7a2d27aa6621ba687a8b18571ce2cd

Download Submit
memory/2336-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2336-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2336-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2336-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2336-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2624-17-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2624-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2624-25-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download