8eb926fff23e14ae296e980014fd11a1de7ba668a49da26f150a7e8d6c81db1f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe
Size

40KB
MD5

739888dd4aeb933297d086d7ff781e9f
SHA1

e1b16a5f265b118ab9815d1db9ff688a4b8db5b0
SHA256

8eb926fff23e14ae296e980014fd11a1de7ba668a49da26f150a7e8d6c81db1f
SHA512

6e4dd8f620fdc987080b57298aca2c7d04bd0b91f552a9ef66d316b85ff73d5c39b73944f1a893d1f4e05650a23904951f2378c46446f2df98001439e31b285e
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDbZ:ZzFbxmLPWQMOtEvwDpjLeJAsKcbZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001424e-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2332	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3048	2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2332	3048	2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe	28
PID 3048 wrote to memory of 2332	3048	2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe	28
PID 3048 wrote to memory of 2332	3048	2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe	28
PID 3048 wrote to memory of 2332	3048	2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-12_739888dd4aeb933297d086d7ff781e9f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
40KB

MD5
74ea15560937161b07f5b417cabb0738

SHA1
03bdb9998ca1e7ff2781a026bb1bc8d7e060ac1d

SHA256
6b148a483a7de2767f35062dcaa887f4dd16a5dd4bfe4e8e07c318e4d32733d2

SHA512
7ed39de3b3ad7ee60d8111f5cbaf6526412d0a9ba5d8e9d2bd1e1763f1029441fc66a06de267a048fceaec2b2393f7fa408574f4d36f1ccd433cf9279c5d066d

Download Submit
memory/2332-16-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2332-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2332-23-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2332-25-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/3048-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3048-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3048-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3048-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download