05fb3f761ae0530c5ca4677f467954e21fa62a743409d0559f8f36978faf5584

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe
Size

73KB
MD5

6bfebcfbc6db59fc9f3e40b2d5716156
SHA1

f6267ae49ede661f383ef2b9eb5301715f2df754
SHA256

05fb3f761ae0530c5ca4677f467954e21fa62a743409d0559f8f36978faf5584
SHA512

0557a3fb6364ed0aa7cfa04a51113f883146ce3344a6903141a7250211e8815da9e7dff1704b474743de468a648599aa7c6e70c46dd58126f8b3ba673c650e9e
SSDEEP

1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9Vy:C4Q2c94OtEvwDpj4H8z9

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2812	202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000014fe1-25.dat	upx
behavioral1/memory/2684-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2812-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2812-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2684-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2684	2812	202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe	28
PID 2812 wrote to memory of 2684	2812	202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe	28
PID 2812 wrote to memory of 2684	2812	202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe	28
PID 2812 wrote to memory of 2684	2812	202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202405216bfebcfbc6db59fc9f3e40b2d5716156cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
896e882877a1cf76c09da82f0dac5fe6

SHA1
cf9646c2b7f3ece09863ebe76b8e82694ec19d7d

SHA256
631fa6012a5f4d45c18fc793bc465632c5bbd83c3d05e1553a856c554d6888c4

SHA512
3c05066e3def902ded240d0546fec7b6819e61fff9d52551c233ab92d9baec2137d0f687df56771d74eba7cbaf670eb709efb7b41ef0b0cd2a115b42c48ac3f5

Download Submit
memory/2684-26-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2684-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2684-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2684-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2812-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2812-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2812-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2812-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2812-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download