2bf05600f1dae21acfdcf001ecd889ec3d40be25759d5f9fa14510ca808838fc

Analysis

max time kernel
151s
max time network
159s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe
Size

77KB
MD5

191e207d044aea0b8d7ee61cf326ab96
SHA1

86c8074175be94492b752131e794ee9416e08103
SHA256

2bf05600f1dae21acfdcf001ecd889ec3d40be25759d5f9fa14510ca808838fc
SHA512

4c5fde92d3ded218050ff310e5e03c2bbae9f07ef7add4edd05ba58db55a602ad51a13722bc21cacbef43e507afaff397734cf994463183584c60792de1affe6
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KU3:ZVxkGOtEvwDpjcaT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014698-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3020	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2904	2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3020	2904	2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe	28
PID 2904 wrote to memory of 3020	2904	2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe	28
PID 2904 wrote to memory of 3020	2904	2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe	28
PID 2904 wrote to memory of 3020	2904	2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_191e207d044aea0b8d7ee61cf326ab96_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
77KB

MD5
18e53f8305953ceb7de0cca39f013955

SHA1
d4e7c2da85b31c91822526e2473ea5d15ef79559

SHA256
c83423ff1f3d7e221a0e5e7afe232adce6d62f6cb162151cfbb77ef74a67a0b4

SHA512
94410ec4bce9ef6b63df482c2aa38a63ce8e8f61a26ff0196aae489e7f9663362ac11d2f65c60c8749cb04b4b7df31a33e9c4f3b2f93b94d2c0da94c2cdcc01e

Download Submit
memory/2904-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2904-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2904-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2904-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3020-16-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/3020-24-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/3020-23-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/3020-25-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download